From 52c30d82a7b12c547c7b04ab37ca532637ff82d5 Mon Sep 17 00:00:00 2001 From: MechaCat02 Date: Thu, 11 Jun 2026 17:02:20 +0200 Subject: [PATCH] [AUDIT-059 R-A] Phase A backward-trace: divergence is sub_822F1AA8 loop exit, not factory/registry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round-37 anchor reframe: both engines install the SAME static .rdata vtable 0x820A183C at [0x828E1F08]. Instance VAs differ only because of ε-class allocator divergence (audit-043). vtable bytes byte-identical; the user prompt's "factory/registry" framing was falsified. Phase A walkthrough (rounds A1..A8): - A.1 canary --audit_jit_prolog_pc=0x821741C8: tid=6, r3=0xBCCC4A80 (= inner sub-object of [0x828E1F08]'s singleton), LR=0x822F1D5C (return-from-bctrl inside sub_822F1AA8) - A.2 found tid=6 spawn site sub_821746B0 at PC 0x82174824 spawning entry=sub_821748F0 ctx=BC365700/BC366DA0. sub_822F1AA8 ALSO spawns a second thread (entry=sub_822F1EE0 ctx=BCE24A40) at PC 0x822F1B08 - A.3 sub_822F1AA8 has 2 callers, both in sub_8216EA68 (its sole caller is sub_824AB748 = entry_point) - A.4 ours mirror probe: sub_821746B0 enters, [0x828E2B14] gate passes, ExCreateThread fires returning handle 0x1070 (= tid=13). Ours' tid=13 IS the same logical thread as canary's spawned silph initializer - A.5 canary --audit_jit_prolog_pc=0x821749C0: fires only 2× on short-lived tid=17, tid=26 (the spawned initializers — NOT tid=6) - A.6 canary --audit_jit_prolog_pc=0x822F1AA8: fires 1× on tid=6 with r3=0xBCE24A40 LR=0x8216EE14 (the second sub_822F1AA8 call site) - A.7 canary --audit_jit_prolog_pc=0x824AB748 (entry_point): fires on tid=00000006. CONFIRMS canary's tid=6 = canary's main thread. Verdict: identical call chain entry_point → sub_8216EA68 → sub_822F1AA8 in both engines; same controller (ε-divergent VA, byte-identical fields). Canary's main thread stays in sub_822F1AA8's dispatcher loop firing sub_821741C8 ~1678×/30s. Ours' main thread exits the loop and thread-joins on the spawned initializer (tid=13), which is itself wedged on handle 0x1078 forever. Loop exit is gated by bit 28 of [r30+0] (the controller's flag word). Same value 0x21 at function entry in both engines. Some code between entry and loop check sets bit 28 in ours but not in canary. Mem-watch on 0x40d09a40 shows zero guest stores in ours' 50M parallel run — setter is either a kernel-side store, computed alias, or probe-quantum-elided JIT store. Phase B classification: Class 3a (state-divergence on controller object). The vtable is the same; the controller's bit 28 evolves differently during sub_822F1AA8 setup. Class 4 (synthesis) is now less attractive since we correctly reach the dispatcher with the right inputs — we just exit too soon. Phase C will need either JIT instrumentation to identify the bit-28 setter, or a kernel-side hook to clear bit 28 on entry to the loop check site. Findings notes: - round-A4b-ours-spawn-gate/FINDINGS.md (spawn topology + tid mapping) - round-A8-ours-822F1AA8-trace/FINDINGS.md (full loop structure + bit-28 gate) New reading-error class #18: probe-output anchor misframing (singleton[VA]=X vtable=Y was misread as "Y is canary-only vtable" when Y is the same .rdata vtable in both engines). Branch: iterate-2C/silph-ui-spawn-trace off master @ 229b46c. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../canary.stdout | 82118 ++++++++++++++++ .../round-A4-ours-chain-probe/ours.log | 66 + .../round-A4b-ours-spawn-gate/FINDINGS.md | 167 + .../round-A4b-ours-spawn-gate/ours.log | 91 + .../round-A5-canary-sub821749C0/canary.stdout | 57950 +++++++++++ .../round-A6-canary-822F1AA8/canary.stdout | 59551 +++++++++++ .../round-A7-canary-entry-point/canary.stdout | 59504 +++++++++++ .../round-A8-ours-822F1AA8-trace/FINDINGS.md | 136 + .../round-A8-ours-822F1AA8-trace/ours.log | 79 + 9 files changed, 259662 insertions(+) create mode 100644 audit-runs/audit-059-handle-disambiguation/round-A1-canary-dispatcher-entry/canary.stdout create mode 100644 audit-runs/audit-059-handle-disambiguation/round-A4-ours-chain-probe/ours.log create mode 100644 audit-runs/audit-059-handle-disambiguation/round-A4b-ours-spawn-gate/FINDINGS.md create mode 100644 audit-runs/audit-059-handle-disambiguation/round-A4b-ours-spawn-gate/ours.log create mode 100644 audit-runs/audit-059-handle-disambiguation/round-A5-canary-sub821749C0/canary.stdout create mode 100644 audit-runs/audit-059-handle-disambiguation/round-A6-canary-822F1AA8/canary.stdout create mode 100644 audit-runs/audit-059-handle-disambiguation/round-A7-canary-entry-point/canary.stdout create mode 100644 audit-runs/audit-059-handle-disambiguation/round-A8-ours-822F1AA8-trace/FINDINGS.md create mode 100644 audit-runs/audit-059-handle-disambiguation/round-A8-ours-822F1AA8-trace/ours.log diff --git a/audit-runs/audit-059-handle-disambiguation/round-A1-canary-dispatcher-entry/canary.stdout b/audit-runs/audit-059-handle-disambiguation/round-A1-canary-dispatcher-entry/canary.stdout new file mode 100644 index 0000000..fba0bc7 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round-A1-canary-dispatcher-entry/canary.stdout @@ -0,0 +1,82118 @@ +i> 000000D8 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D8 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D8 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = true +audit_jit_prolog_mem_dump = 0 +audit_jit_prolog_pc = 2182918192 +audit_jit_prolog_r3_bytes = 64 +audit_track_event_handle = 0 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D8 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D8 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D8 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D8 Unable to load Japanese font; JP characters will be boxes +w> 000000D8 Unable to load Japanese font; JP characters will be boxes +i> 00000128 Setup: Initializing Memory... +i> 00000128 Setup: Initializing Exports... +i> 00000128 Setup: Initializing Processor... +i> 00000128 Setup: Initializing Audio... +i> 00000128 Setup: Initializing Graphics... +i> 00000128 Setup: Initializing HID... +i> 00000128 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000128 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000128 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000128 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000128 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000128 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000128 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000128 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000128 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000128 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000128 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000128 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000128 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000128 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000128 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000128 winkey: "L" binds key 0x4C to controller input X. +i> 00000128 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000128 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000128 winkey: "P" binds key 0x50 to controller input Y. +i> 00000128 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000128 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000128 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000128 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000128 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000128 winkey: "X" binds key 0x58 to controller input START. +i> 00000128 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000128 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D8 SDL Version 2.32.2 initialized. +w> 000000D8 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000128 Setup: Initializing VFS... +i> 00000128 PatchDB: Loaded patches for 0 titles +i> 00000128 Setup: Initializing Kernel... +i> 00000128 ProfileManager: Found 0 Profiles +w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page +K> 00000128 AUDIT-HLC XEvent::Set handle=F8000000 kevent_va=00000000 prio=1 lr=00000000 +i> 00000128 Setup: Starting graphics_system... +i> 00000128 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000128 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000128 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000128 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000128 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000158, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=0000015C, ) +i> 00000128 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000128 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000160, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000164, ) +i> 000000D8 Checking for XISO +F> 000000D8 DiscImageDevice::Initialize +i> 000000D8 Checking for XISO +F> 000000D8 DiscImageDevice::Initialize +F> 000000D8 DiscImageDevice::Initialize +i> 000000D8 Loading module GAME:\default.xex +F> 000000D8 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D8 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D8 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D8 Title name: PROJECT SYLPHEED +i> 000000D8 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D8 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D8 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D8 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D8 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D8 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D8 KernelState: Launching module... +i> 000000D8 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000194, ) +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000198) +K> F8000008 AUDIT-HLC XThread::Execute tid=6 start_address=824AB748 start_context=00000000 xapi=00000000 +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +i> 01000010 Translated 7 shaders in 2 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800000C kevent_va=30029018 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01BC (F8000010)', native=000001BC) +K> F8000010 AUDIT-HLC XThread::Execute tid=7 start_address=824A93C8 start_context=828A28F0 xapi=00000000 +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000010 AUDIT-HLC XEvent::Set handle=F8000014 kevent_va=00000000 prio=1 lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000020 kevent_va=3002F018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=82181830 start_ctx=828F3D08 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=821817FC +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01C0 (F8000024)', native=000001C0) +K> F8000024 AUDIT-HLC XThread::Execute tid=8 start_address=82181830 start_context=828F3D08 xapi=824AFF88 +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +K> F8000008 AUDIT-HLC ExCreateThread entry=8245A5D0 start_ctx=828F4838 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=824592B4 +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C4 (F800002C)', native=000001C4) +K> F800002C AUDIT-HLC XThread::Execute tid=9 start_address=8245A5D0 start_context=828F4838 xapi=824AFF88 +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000038 kevent_va=3003B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800003C kevent_va=3003D018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=82450A28 start_ctx=828F3B68 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82450034 +i> F8000008 XThreadF8000044 (A) Stack: 70300000-70340000 +K> F8000044 XThread::Execute thid 10 (handle=F8000044, 'XThread01C8 (F8000044)', native=000001C8) +K> F8000044 AUDIT-HLC XThread::Execute tid=10 start_address=82450A28 start_context=828F3B68 xapi=824AFF88 +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000038 dst=F8000048 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800004C kevent_va=30045018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800004C kevent_va=30045018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800004C kevent_va=30045018 prio=0 lr=824AAFC8 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000048 lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=3003B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000034 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000034 kevent_va=3003B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000034 dst=F8000038 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000048 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000048 kevent_va=30045018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000048 kevent_va=30045018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000048 kevent_va=30045018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000048 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000048 kevent_va=30045018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800004C kevent_va=30047018 lr=824A9F6C +K> F8000044 AUDIT-HLC ExCreateThread entry=82457EF0 start_ctx=828F3B08 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82457EA0 +i> F8000044 XThreadF8000054 (B) Stack: 70360000-70370000 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000048 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 XThread::Execute thid 11 (handle=F8000054, 'XThread01CC (F8000054)', native=000001CC) +K> F8000054 AUDIT-HLC XThread::Execute tid=11 start_address=82457EF0 start_context=828F3B08 xapi=824AFF88 +K> F8000054 AUDIT-HLC NtSetEvent handle=F8000048 lr=824AA304 guest_lr=82457F18 +K> F8000054 AUDIT-HLC XEvent::Set handle=F8000048 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000048 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=3003B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000034 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000034 kevent_va=30045018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=824CD458 start_ctx=BE56BB3C xapi=00000000 flags=04000080 lr=824CD984 guest_lr=824C1AD8 +i> F8000008 XThreadF8000048 (C) Stack: 70390000-703A0000 +K> F8000048 XThread::Execute thid 12 (handle=F8000048, 'XThread01D0 (F8000048)', native=000001D0) +K> F8000048 AUDIT-HLC XThread::Execute tid=12 start_address=824CD458 start_context=BE56BB3C xapi=00000000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC singleton[0x828E1F08]=BC22C910 vtable=820A183C vtable[0]=82175330 vtable[24]=82175378 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800005C type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800005C kevent_va=30053018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000060 kevent_va=30055018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=822F1EE0 start_ctx=BCE24A40 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822F1B0C +i> F8000008 XThreadF8000064 (D) Stack: 703C0000-70440000 +K> F8000064 XThread::Execute thid 13 (handle=F8000064, 'XThread01D4 (F8000064)', native=000001D4) +K> F8000064 AUDIT-HLC XThread::Execute tid=13 start_address=822F1EE0 start_context=BCE24A40 xapi=824AFF88 +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800006C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800006C kevent_va=3005B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F800006C dst=F8000070 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800006C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000074 kevent_va=3005D018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000074 kevent_va=3005D018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=3005D018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000074 kevent_va=3005D018 lr=824A9F6C +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=8245802C +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000074 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 guest_lr=82457F18 +K> F8000054 AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=3005D018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000074 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000070 lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800006C kevent_va=3005B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800006C result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800006C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800006C kevent_va=3005B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F800006C dst=F8000070 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800006C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000074 kevent_va=3005D018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000074 kevent_va=3005D018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=3005D018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000074 kevent_va=3005D018 lr=824A9F6C +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=8245802C +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000074 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 guest_lr=82457F18 +K> F8000054 AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=3005D018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000074 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000070 lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800006C kevent_va=3005B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800006C result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC ExCreateThread entry=824D2878 start_ctx=00000000 xapi=00000000 flags=10000001 lr=824D2E68 guest_lr=824D059C +i> F8000008 XThreadF800006C (E) Stack: 70460000-704E0000 +K> F8000008 AUDIT-HLC ExCreateThread entry=824D2940 start_ctx=00000000 xapi=00000000 flags=20000001 lr=824D2E68 guest_lr=824D059C +i> F8000008 XThreadF8000070 (F) Stack: 70500000-70580000 +K> F800006C XThread::Execute thid 14 (handle=F800006C, 'XThread01D8 (F800006C)', native=000001D8) +K> F800006C AUDIT-HLC XThread::Execute tid=14 start_address=824D2878 start_context=00000000 xapi=00000000 +K> F8000070 XThread::Execute thid 15 (handle=F8000070, 'XThread01DC (F8000070)', native=000001DC) +K> F8000070 AUDIT-HLC XThread::Execute tid=15 start_address=824D2940 start_context=00000000 xapi=00000000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x787c44e61c90 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000084 kevent_va=30064018 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30066018 prio=0 lr=824AAFC8 +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtDuplicateObject src=F8000084 dst=F800008C options=00000002 lr=824AA3B4 +K> F8000044 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=82460EC0 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000084 kevent_va=30064018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000084 kevent_va=30064018 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000084 dst=F800008C options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=82460078 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000084 kevent_va=30064018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000084 kevent_va=30064018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000084 dst=F800008C options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000084 kevent_va=30064018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=82179148 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC ExCreateThread entry=82178950 start_ctx=828F3EC0 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82178F08 +i> F8000008 XThreadF8000084 (10) Stack: 705A0000-705B0000 +K> F8000084 XThread::Execute thid 16 (handle=F8000084, 'XThread01F0 (F8000084)', native=000001F0) +K> F8000084 AUDIT-HLC XThread::Execute tid=16 start_address=82178950 start_context=828F3EC0 xapi=824AFF88 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82173BD4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=822F1FC8 +K> F8000064 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 guest_lr=82173BF0 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=30045018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=821748F0 start_ctx=BC365700 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=82174828 +i> F8000008 XThreadF8000090 (11) Stack: 705D0000-70650000 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000090 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000090 XThread::Execute thid 17 (handle=F8000090, 'XThread01F4 (F8000090)', native=000001F4) +K> F8000090 AUDIT-HLC XThread::Execute tid=17 start_address=821748F0 start_context=BC365700 xapi=824AFF88 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000090 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=1 lr=824A9F6C +K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=3006E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30070018 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000090 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000090 AUDIT-HLC NtDuplicateObject src=F8000098 dst=F80000A0 options=00000002 lr=824AA3B4 +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A4 kevent_va=30072018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A4 kevent_va=30072018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A4 kevent_va=30072018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A4 kevent_va=30072018 lr=824A9F6C +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=8245802C +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 AUDIT-HLC NtSetEvent handle=F80000A4 lr=824AA304 guest_lr=82457F18 +K> F8000054 AUDIT-HLC XEvent::Set handle=F80000A4 kevent_va=30072018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A4 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000A0 lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30070018 prio=0 lr=824AA304 +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> F8000090 AUDIT-HLC ExCreateThread entry=821C4AD0 start_ctx=BCA44C00 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=821C4F64 +i> F8000090 XThreadF8000098 (12) Stack: 70670000-70680000 +K> F8000098 XThread::Execute thid 18 (handle=F8000098, 'XThread01F8 (F8000098)', native=000001F8) +K> F8000098 AUDIT-HLC XThread::Execute tid=18 start_address=821C4AD0 start_context=BCA44C00 xapi=824AFF88 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000098 AUDIT-HLC ExCreateThread entry=822C6870 start_ctx=828F3300 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822C66F4 +i> F8000098 XThreadF80000A0 (13) Stack: 706A0000-706D0000 +K> F8000098 AUDIT-HLC ExCreateThread entry=822C6870 start_ctx=828F3300 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822C66F4 +i> F8000098 XThreadF80000A4 (14) Stack: 706F0000-70720000 +K> F80000A0 XThread::Execute thid 19 (handle=F80000A0, 'XThread01FC (F80000A0)', native=000001FC) +K> F80000A0 AUDIT-HLC XThread::Execute tid=19 start_address=822C6870 start_context=828F3300 xapi=824AFF88 +K> F80000A4 XThread::Execute thid 20 (handle=F80000A4, 'XThread0200 (F80000A4)', native=00000200) +K> F80000A4 AUDIT-HLC XThread::Execute tid=20 start_address=822C6870 start_context=828F3300 xapi=824AFF88 +K> F80000A4 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=3007E018 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000090 HostPathDevice::ResolvePath(\87719002\c) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000B0 options=00000002 lr=824AA3B4 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=30080018 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000090 HostPathDevice::ResolvePath(\87719002\c) +K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000B4 dst=F80000BC options=00000002 lr=824AA3B4 +F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000C4 kevent_va=30082018 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C8 type=1 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000C8 kevent_va=30084018 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\a) +K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000C4 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000D4 kevent_va=30086018 lr=824A9F6C +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000C8 dst=F80000D8 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +F> F8000090 HostPathDevice::ResolvePath(\87719002\2\85d8849) +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +F> F8000090 HostPathDevice::ResolvePath(\87719002\2) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000D4 dst=F80000E0 options=00000002 lr=824AA3B4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000E4 kevent_va=30088018 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000090 HostPathDevice::ResolvePath(\87719002\a) +K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000E4 dst=F80000EC options=00000002 lr=824AA3B4 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000F0 kevent_va=3008A018 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000090 HostPathDevice::ResolvePath(\87719002\c) +K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000F0 dst=F80000F8 options=00000002 lr=824AA3B4 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000FC kevent_va=3008C018 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000090 HostPathDevice::ResolvePath(\87719002\0) +K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000FC dst=F8000104 options=00000002 lr=824AA3B4 +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C515C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000108 kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000108 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000108 kevent_va=3008E018 prio=0 lr=824AAFC8 +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=30080018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C4 kevent_va=30082018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=30084018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000C8 dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000E0 lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=30086018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000EC lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000E4 kevent_va=30088018 prio=0 lr=824AA304 +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=30088018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000090 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=30088018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000F8 lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000F0 kevent_va=3008A018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=30088018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=30088018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=30088018 prio=0 lr=824AAFC8 +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000104 lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000FC kevent_va=3008C018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3006A018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=824563E0 start_ctx=828F3E70 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82456A44 +i> F8000008 XThreadF80000B8 (15) Stack: 705D0000-705E0000 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F80000B8 XThread::Execute thid 21 (handle=F80000B8, 'XThread0204 (F80000B8)', native=00000204) +K> F80000B8 AUDIT-HLC XThread::Execute tid=21 start_address=824563E0 start_context=828F3E70 xapi=824AFF88 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000022 r5=828F3888 r6=701CF924 r7=82456F00 r8=00000000 r9=00000000 r10=00000022 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00010004 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 BC365BC0 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000000 00000000 00000000 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000CC kevent_va=30090018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=82170430 start_ctx=828F4070 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82170260 +i> F8000008 XThreadF80000D0 (16) Stack: 70600000-70610000 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F80000D0 XThread::Execute thid 22 (handle=F80000D0, 'XThread0208 (F80000D0)', native=00000208) +K> F80000D0 AUDIT-HLC XThread::Execute tid=22 start_address=82170430 start_context=828F4070 xapi=824AFF88 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000D8 kevent_va=30096018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000064 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 guest_lr=822F1FC8 +K> F8000064 AUDIT-HLC XEvent::Set handle=F80000D8 kevent_va=30096018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=30084018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F80000D0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000C8 dst=F800008C options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000D8 kevent_va=30096018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=3009A018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDE30 start_ctx=828F3C4C xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=823DDDB4 +i> F8000008 XThreadF80000E8 (17) Stack: 70630000-70640000 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F80000E8 XThread::Execute thid 23 (handle=F80000E8, 'XThread020C (F80000E8)', native=0000020C) +K> F80000E8 AUDIT-HLC XThread::Execute tid=23 start_address=823DDE30 start_context=828F3C4C xapi=824AFF88 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000EC kevent_va=300A2018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDB50 start_ctx=828F3C88 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=823DD924 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +i> F8000008 XThreadF80000F8 (18) Stack: 70740000-707C0000 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDB50 start_ctx=828F3C88 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=823DD924 +i> F8000008 XThreadF8000104 (19) Stack: 707E0000-70860000 +K> F80000F8 XThread::Execute thid 24 (handle=F80000F8, 'XThread0210 (F80000F8)', native=00000210) +K> F80000F8 AUDIT-HLC XThread::Execute tid=24 start_address=823DDB50 start_context=828F3C88 xapi=824AFF88 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000104 XThread::Execute thid 25 (handle=F8000104, 'XThread0214 (F8000104)', native=00000214) +K> F8000104 AUDIT-HLC XThread::Execute tid=25 start_address=823DDB50 start_context=828F3C88 xapi=824AFF88 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 guest_lr=82172DF4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000003 r5=828F3888 r6=701CF924 r7=BC22CA60 r8=00000001 r9=00000000 r10=00000026 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000064 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 guest_lr=822F1FC8 +K> F8000064 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=30084018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=1 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 guest_lr=821CC1B8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000007 r5=828F3888 r6=701CF924 r7=00000000 r8=00000002 r9=00000000 r10=0000002E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: 00000000 00000001 30057018 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000002 r5=828F3888 r6=701CF924 r7=00000000 r8=00000003 r9=00000000 r10=00000031 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000108 kevent_va=00000000 prio=1 lr=823DF714 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000004 r9=00000000 r10=00000032 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=1 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827EED8C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827ED704 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtDuplicateObject src=F800008C dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82460EC0 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000005 r9=00000000 r10=00000033 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtDuplicateObject src=F800008C dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82460EC0 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtDuplicateObject src=F800008C dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82460EC0 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtDuplicateObject src=F800008C dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82460EC0 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtDuplicateObject src=F800008C dst=F80000AC options=00000002 lr=824AA3B4 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82460EC0 +K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000006 r9=00000000 r10=00000034 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827ECBB8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E9C9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000007 r9=00000000 r10=00000035 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000008 r9=00000000 r10=00000036 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000009 r9=00000000 r10=00000037 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000A r9=00000000 r10=00000038 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000B r9=00000000 r10=00000039 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000C r9=00000000 r10=0000003A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000D r9=00000000 r10=0000003B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000E r9=00000000 r10=0000003C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000F r9=00000000 r10=0000003D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000010 r9=00000000 r10=0000003E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000011 r9=00000000 r10=0000003F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000012 r9=00000000 r10=00000040 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000013 r9=00000000 r10=00000041 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000014 r9=00000000 r10=00000042 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000015 r9=00000000 r10=00000043 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000016 r9=00000000 r10=00000044 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000017 r9=00000000 r10=00000045 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000018 r9=00000000 r10=00000046 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000019 r9=00000000 r10=00000047 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001A r9=00000000 r10=00000048 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001B r9=00000000 r10=00000049 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001C r9=00000000 r10=0000004A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001D r9=00000000 r10=0000004B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001E r9=00000000 r10=0000004C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001F r9=00000000 r10=0000004D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000020 r9=00000000 r10=0000004E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000021 r9=00000000 r10=0000004F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000022 r9=00000000 r10=00000050 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000023 r9=00000000 r10=00000051 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000024 r9=00000000 r10=00000052 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000025 r9=00000000 r10=00000053 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000026 r9=00000000 r10=00000054 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000027 r9=00000000 r10=00000055 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000028 r9=00000000 r10=00000056 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000029 r9=00000000 r10=00000057 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002A r9=00000000 r10=00000058 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002B r9=00000000 r10=00000059 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002C r9=00000000 r10=0000005A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002D r9=00000000 r10=0000005B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002E r9=00000000 r10=0000005C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002F r9=00000000 r10=0000005D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000030 r9=00000000 r10=0000005E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000031 r9=00000000 r10=0000005F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000032 r9=00000000 r10=00000060 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000033 r9=00000000 r10=00000061 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000034 r9=00000000 r10=00000062 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000035 r9=00000000 r10=00000063 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000036 r9=00000000 r10=00000064 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000037 r9=00000000 r10=00000065 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000038 r9=00000000 r10=00000066 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000039 r9=00000000 r10=00000067 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003A r9=00000000 r10=00000068 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003B r9=00000000 r10=00000069 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003C r9=00000000 r10=0000006A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003D r9=00000000 r10=0000006B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003E r9=00000000 r10=0000006C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003F r9=00000000 r10=0000006D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000040 r9=00000000 r10=0000006E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000041 r9=00000000 r10=0000006F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000042 r9=00000000 r10=00000070 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000043 r9=00000000 r10=00000071 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000044 r9=00000000 r10=00000072 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000045 r9=00000000 r10=00000073 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000046 r9=00000000 r10=00000074 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000047 r9=00000000 r10=00000075 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000048 r9=00000000 r10=00000076 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000049 r9=00000000 r10=00000077 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004A r9=00000000 r10=00000078 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004B r9=00000000 r10=00000079 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004C r9=00000000 r10=0000007A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004D r9=00000000 r10=0000007B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004E r9=00000000 r10=0000007C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004F r9=00000000 r10=0000007D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000050 r9=00000000 r10=0000007E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000051 r9=00000000 r10=0000007F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000052 r9=00000000 r10=00000080 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000053 r9=00000000 r10=00000081 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000054 r9=00000000 r10=00000082 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000055 r9=00000000 r10=00000083 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000056 r9=00000000 r10=00000084 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000057 r9=00000000 r10=00000085 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000058 r9=00000000 r10=00000086 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000059 r9=00000000 r10=00000087 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005A r9=00000000 r10=00000088 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005B r9=00000000 r10=00000089 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005C r9=00000000 r10=0000008A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005D r9=00000000 r10=0000008B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005E r9=00000000 r10=0000008C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005F r9=00000000 r10=0000008D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000060 r9=00000000 r10=0000008E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000061 r9=00000000 r10=0000008F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000062 r9=00000000 r10=00000090 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000063 r9=00000000 r10=00000091 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000064 r9=00000000 r10=00000092 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000065 r9=00000000 r10=00000093 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000066 r9=00000000 r10=00000094 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000067 r9=00000000 r10=00000095 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000068 r9=00000000 r10=00000096 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000069 r9=00000000 r10=00000097 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006A r9=00000000 r10=00000098 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006B r9=00000000 r10=00000099 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006C r9=00000000 r10=0000009A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006D r9=00000000 r10=0000009B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006E r9=00000000 r10=0000009C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006F r9=00000000 r10=0000009D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000070 r9=00000000 r10=0000009E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000071 r9=00000000 r10=0000009F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000072 r9=00000000 r10=000000A0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000073 r9=00000000 r10=000000A1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000074 r9=00000000 r10=000000A2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000075 r9=00000000 r10=000000A3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000076 r9=00000000 r10=000000A4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000077 r9=00000000 r10=000000A5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000078 r9=00000000 r10=000000A6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000079 r9=00000000 r10=000000A7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007A r9=00000000 r10=000000A8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007B r9=00000000 r10=000000A9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007C r9=00000000 r10=000000AA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007D r9=00000000 r10=000000AB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007E r9=00000000 r10=000000AC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007F r9=00000000 r10=000000AD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000080 r9=00000000 r10=000000AE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000081 r9=00000000 r10=000000AF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000082 r9=00000000 r10=000000B0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000083 r9=00000000 r10=000000B1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000084 r9=00000000 r10=000000B2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000085 r9=00000000 r10=000000B3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000086 r9=00000000 r10=000000B4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000087 r9=00000000 r10=000000B5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000088 r9=00000000 r10=000000B6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000089 r9=00000000 r10=000000B7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008A r9=00000000 r10=000000B8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008B r9=00000000 r10=000000B9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008C r9=00000000 r10=000000BA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008D r9=00000000 r10=000000BB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008E r9=00000000 r10=000000BC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008F r9=00000000 r10=000000BD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000090 r9=00000000 r10=000000BE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000091 r9=00000000 r10=000000BF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000092 r9=00000000 r10=000000C0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000093 r9=00000000 r10=000000C1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000094 r9=00000000 r10=000000C2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000095 r9=00000000 r10=000000C3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000096 r9=00000000 r10=000000C4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000097 r9=00000000 r10=000000C5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000098 r9=00000000 r10=000000C6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000099 r9=00000000 r10=000000C7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009A r9=00000000 r10=000000C8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009B r9=00000000 r10=000000C9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009C r9=00000000 r10=000000CA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009D r9=00000000 r10=000000CB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009E r9=00000000 r10=000000CC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009F r9=00000000 r10=000000CD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A0 r9=00000000 r10=000000CE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A1 r9=00000000 r10=000000CF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A2 r9=00000000 r10=000000D0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A3 r9=00000000 r10=000000D1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A4 r9=00000000 r10=000000D2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A5 r9=00000000 r10=000000D3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A6 r9=00000000 r10=000000D4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A7 r9=00000000 r10=000000D5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A8 r9=00000000 r10=000000D6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A9 r9=00000000 r10=000000D7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AA r9=00000000 r10=000000D8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AB r9=00000000 r10=000000D9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AC r9=00000000 r10=000000DA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AD r9=00000000 r10=000000DB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AE r9=00000000 r10=000000DC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AF r9=00000000 r10=000000DD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B0 r9=00000000 r10=000000DE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B1 r9=00000000 r10=000000DF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B2 r9=00000000 r10=000000E0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B3 r9=00000000 r10=000000E1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B4 r9=00000000 r10=000000E2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B5 r9=00000000 r10=000000E3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B6 r9=00000000 r10=000000E4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B7 r9=00000000 r10=000000E5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B8 r9=00000000 r10=000000E6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B9 r9=00000000 r10=000000E7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BA r9=00000000 r10=000000E8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BB r9=00000000 r10=000000E9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BC r9=00000000 r10=000000EA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BD r9=00000000 r10=000000EB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BE r9=00000000 r10=000000EC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BF r9=00000000 r10=000000ED lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C0 r9=00000000 r10=000000EE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C1 r9=00000000 r10=000000EF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C2 r9=00000000 r10=000000F0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C3 r9=00000000 r10=000000F1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C4 r9=00000000 r10=000000F2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C5 r9=00000000 r10=000000F3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C6 r9=00000000 r10=000000F4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C7 r9=00000000 r10=000000F5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C8 r9=00000000 r10=000000F6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C9 r9=00000000 r10=000000F7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CA r9=00000000 r10=000000F8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CB r9=00000000 r10=000000F9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CC r9=00000000 r10=000000FA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CD r9=00000000 r10=000000FB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CE r9=00000000 r10=000000FC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CF r9=00000000 r10=000000FD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D0 r9=00000000 r10=000000FE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D1 r9=00000000 r10=000000FF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D2 r9=00000000 r10=00000100 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D3 r9=00000000 r10=00000101 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D4 r9=00000000 r10=00000102 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D5 r9=00000000 r10=00000103 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D6 r9=00000000 r10=00000104 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D7 r9=00000000 r10=00000105 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D8 r9=00000000 r10=00000106 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D9 r9=00000000 r10=00000107 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DA r9=00000000 r10=00000108 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DB r9=00000000 r10=00000109 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DC r9=00000000 r10=0000010A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DD r9=00000000 r10=0000010B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DE r9=00000000 r10=0000010C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DF r9=00000000 r10=0000010D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E0 r9=00000000 r10=0000010E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E1 r9=00000000 r10=0000010F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E2 r9=00000000 r10=00000110 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E3 r9=00000000 r10=00000111 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E4 r9=00000000 r10=00000112 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E5 r9=00000000 r10=00000113 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E6 r9=00000000 r10=00000114 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E7 r9=00000000 r10=00000115 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E8 r9=00000000 r10=00000116 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E9 r9=00000000 r10=00000117 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000EA r9=00000000 r10=00000118 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000EB r9=00000000 r10=00000119 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000EC r9=00000000 r10=0000011A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000ED r9=00000000 r10=0000011B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000EE r9=00000000 r10=0000011C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000EF r9=00000000 r10=0000011D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F0 r9=00000000 r10=0000011E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F1 r9=00000000 r10=0000011F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F2 r9=00000000 r10=00000120 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F3 r9=00000000 r10=00000121 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F4 r9=00000000 r10=00000122 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F5 r9=00000000 r10=00000123 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F6 r9=00000000 r10=00000124 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F7 r9=00000000 r10=00000125 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F8 r9=00000000 r10=00000126 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=3006E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=03A723D0 r8=000000F9 r9=00000000 r10=00000127 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FA r9=00000000 r10=00000128 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FB r9=00000000 r10=00000129 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000064 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=822F1FC8 +K> F8000064 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 guest_lr=821CC1B8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FC r9=00000000 r10=0000012A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: 00000000 00000001 30057018 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FD r9=00000000 r10=0000012B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FE r9=00000000 r10=0000012C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FF r9=00000000 r10=0000012D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000100 r9=00000000 r10=0000012E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000101 r9=00000000 r10=0000012F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000102 r9=00000000 r10=00000130 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000103 r9=00000000 r10=00000131 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000104 r9=00000000 r10=00000132 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000105 r9=00000000 r10=00000133 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000106 r9=00000000 r10=00000134 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000107 r9=00000000 r10=00000135 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000108 r9=00000000 r10=00000136 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000109 r9=00000000 r10=00000137 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010A r9=00000000 r10=00000138 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010B r9=00000000 r10=00000139 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010C r9=00000000 r10=0000013A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010D r9=00000000 r10=0000013B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010E r9=00000000 r10=0000013C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010F r9=00000000 r10=0000013D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000110 r9=00000000 r10=0000013E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000111 r9=00000000 r10=0000013F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000112 r9=00000000 r10=00000140 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000113 r9=00000000 r10=00000141 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000114 r9=00000000 r10=00000142 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000115 r9=00000000 r10=00000143 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000116 r9=00000000 r10=00000144 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000117 r9=00000000 r10=00000145 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000118 r9=00000000 r10=00000146 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000119 r9=00000000 r10=00000147 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011A r9=00000000 r10=00000148 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011B r9=00000000 r10=00000149 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011C r9=00000000 r10=0000014A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011D r9=00000000 r10=0000014B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011E r9=00000000 r10=0000014C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011F r9=00000000 r10=0000014D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000120 r9=00000000 r10=0000014E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000121 r9=00000000 r10=0000014F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000122 r9=00000000 r10=00000150 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000123 r9=00000000 r10=00000151 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000124 r9=00000000 r10=00000152 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000125 r9=00000000 r10=00000153 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000126 r9=00000000 r10=00000154 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000127 r9=00000000 r10=00000155 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000128 r9=00000000 r10=00000156 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000129 r9=00000000 r10=00000157 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012A r9=00000000 r10=00000158 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012B r9=00000000 r10=00000159 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012C r9=00000000 r10=0000015A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012D r9=00000000 r10=0000015B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012E r9=00000000 r10=0000015C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012F r9=00000000 r10=0000015D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000130 r9=00000000 r10=0000015E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000131 r9=00000000 r10=0000015F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000132 r9=00000000 r10=00000160 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000133 r9=00000000 r10=00000161 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000134 r9=00000000 r10=00000162 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000135 r9=00000000 r10=00000163 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000136 r9=00000000 r10=00000164 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000137 r9=00000000 r10=00000165 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000138 r9=00000000 r10=00000166 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000139 r9=00000000 r10=00000167 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013A r9=00000000 r10=00000168 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013B r9=00000000 r10=00000169 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013C r9=00000000 r10=0000016A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013D r9=00000000 r10=0000016B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013E r9=00000000 r10=0000016C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013F r9=00000000 r10=0000016D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000140 r9=00000000 r10=0000016E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000141 r9=00000000 r10=0000016F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000142 r9=00000000 r10=00000170 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000143 r9=00000000 r10=00000171 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000144 r9=00000000 r10=00000172 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000145 r9=00000000 r10=00000173 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000146 r9=00000000 r10=00000174 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000147 r9=00000000 r10=00000175 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000148 r9=00000000 r10=00000176 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000149 r9=00000000 r10=00000177 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014A r9=00000000 r10=00000178 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014B r9=00000000 r10=00000179 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014C r9=00000000 r10=0000017A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014D r9=00000000 r10=0000017B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014E r9=00000000 r10=0000017C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014F r9=00000000 r10=0000017D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000150 r9=00000000 r10=0000017E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000151 r9=00000000 r10=0000017F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000152 r9=00000000 r10=00000180 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000153 r9=00000000 r10=00000181 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000154 r9=00000000 r10=00000182 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000155 r9=00000000 r10=00000183 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000156 r9=00000000 r10=00000184 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000157 r9=00000000 r10=00000185 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000158 r9=00000000 r10=00000186 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000159 r9=00000000 r10=00000187 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015A r9=00000000 r10=00000188 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015B r9=00000000 r10=00000189 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015C r9=00000000 r10=0000018A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015D r9=00000000 r10=0000018B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015E r9=00000000 r10=0000018C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015F r9=00000000 r10=0000018D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000160 r9=00000000 r10=0000018E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000161 r9=00000000 r10=0000018F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000162 r9=00000000 r10=00000190 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000163 r9=00000000 r10=00000191 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000164 r9=00000000 r10=00000192 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000165 r9=00000000 r10=00000193 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000166 r9=00000000 r10=00000194 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000167 r9=00000000 r10=00000195 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000168 r9=00000000 r10=00000196 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000169 r9=00000000 r10=00000197 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016A r9=00000000 r10=00000198 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016B r9=00000000 r10=00000199 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016C r9=00000000 r10=0000019A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016D r9=00000000 r10=0000019B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016E r9=00000000 r10=0000019C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016F r9=00000000 r10=0000019D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000170 r9=00000000 r10=0000019E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000171 r9=00000000 r10=0000019F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000172 r9=00000000 r10=000001A0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000173 r9=00000000 r10=000001A1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000174 r9=00000000 r10=000001A2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000175 r9=00000000 r10=000001A3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000176 r9=00000000 r10=000001A4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000177 r9=00000000 r10=000001A5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000178 r9=00000000 r10=000001A6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000179 r9=00000000 r10=000001A7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017A r9=00000000 r10=000001A8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017B r9=00000000 r10=000001A9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017C r9=00000000 r10=000001AA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017D r9=00000000 r10=000001AB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017E r9=00000000 r10=000001AC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017F r9=00000000 r10=000001AD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000180 r9=00000000 r10=000001AE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000181 r9=00000000 r10=000001AF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000182 r9=00000000 r10=000001B0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000183 r9=00000000 r10=000001B1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000184 r9=00000000 r10=000001B2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000185 r9=00000000 r10=000001B3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000186 r9=00000000 r10=000001B4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000187 r9=00000000 r10=000001B5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000188 r9=00000000 r10=000001B6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000189 r9=00000000 r10=000001B7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018A r9=00000000 r10=000001B8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018B r9=00000000 r10=000001B9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018C r9=00000000 r10=000001BA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018D r9=00000000 r10=000001BB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018E r9=00000000 r10=000001BC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018F r9=00000000 r10=000001BD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000190 r9=00000000 r10=000001BE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000191 r9=00000000 r10=000001BF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000192 r9=00000000 r10=000001C0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000193 r9=00000000 r10=000001C1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000194 r9=00000000 r10=000001C2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000195 r9=00000000 r10=000001C3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000196 r9=00000000 r10=000001C4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000197 r9=00000000 r10=000001C5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000198 r9=00000000 r10=000001C6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000199 r9=00000000 r10=000001C7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019A r9=00000000 r10=000001C8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019B r9=00000000 r10=000001C9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019C r9=00000000 r10=000001CA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019D r9=00000000 r10=000001CB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019E r9=00000000 r10=000001CC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019F r9=00000000 r10=000001CD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A0 r9=00000000 r10=000001CE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A1 r9=00000000 r10=000001CF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A2 r9=00000000 r10=000001D0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A3 r9=00000000 r10=000001D1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A4 r9=00000000 r10=000001D2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A5 r9=00000000 r10=000001D3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A6 r9=00000000 r10=000001D4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A7 r9=00000000 r10=000001D5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A8 r9=00000000 r10=000001D6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A9 r9=00000000 r10=000001D7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AA r9=00000000 r10=000001D8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AB r9=00000000 r10=000001D9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AC r9=00000000 r10=000001DA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AD r9=00000000 r10=000001DB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AE r9=00000000 r10=000001DC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AF r9=00000000 r10=000001DD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B0 r9=00000000 r10=000001DE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B1 r9=00000000 r10=000001DF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B2 r9=00000000 r10=000001E0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B3 r9=00000000 r10=000001E1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B4 r9=00000000 r10=000001E2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B5 r9=00000000 r10=000001E3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B6 r9=00000000 r10=000001E4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B7 r9=00000000 r10=000001E5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B8 r9=00000000 r10=000001E6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B9 r9=00000000 r10=000001E7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BA r9=00000000 r10=000001E8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BB r9=00000000 r10=000001E9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BC r9=00000000 r10=000001EA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BD r9=00000000 r10=000001EB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BE r9=00000000 r10=000001EC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BF r9=00000000 r10=000001ED lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C0 r9=00000000 r10=000001EE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C1 r9=00000000 r10=000001EF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C2 r9=00000000 r10=000001F0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C3 r9=00000000 r10=000001F1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C4 r9=00000000 r10=000001F2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C5 r9=00000000 r10=000001F3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C6 r9=00000000 r10=000001F4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C7 r9=00000000 r10=000001F5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C8 r9=00000000 r10=000001F6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C9 r9=00000000 r10=000001F7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001CA r9=00000000 r10=000001F8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001CB r9=00000000 r10=000001F9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001CC r9=00000000 r10=000001FA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001CD r9=00000000 r10=000001FB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001CE r9=00000000 r10=000001FC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=3006E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=03A723D0 r8=000001CF r9=00000000 r10=000001FD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D0 r9=00000000 r10=000001FE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D1 r9=00000000 r10=000001FF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D2 r9=00000000 r10=00000200 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=821748F0 start_ctx=BC366DA0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=82174828 +i> F8000008 XThreadF80000A8 (1A) Stack: 70880000-70900000 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F80000A8 XThread::Execute thid 26 (handle=F80000A8, 'XThread0218 (F80000A8)', native=00000218) +K> F80000A8 AUDIT-HLC XThread::Execute tid=26 start_address=821748F0 start_context=BC366DA0 xapi=824AFF88 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F80000A8 AUDIT-HLC NtCreateEvent handle=F80000AC type=1 initial_state=1 lr=824A9F6C +K> F80000A8 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30084018 lr=824A9F6C +K> F80000A8 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F80000A8 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=300B0018 lr=824A9F6C +F> F80000A8 HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000A8 HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000A8 AUDIT-HLC NtDuplicateObject src=F80000B4 dst=F800010C options=00000002 lr=824AA3B4 +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B4 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B2018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D3 r9=00000000 r10=00000201 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D4 r9=00000000 r10=00000202 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D5 r9=00000000 r10=00000203 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D6 r9=00000000 r10=00000204 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D7 r9=00000000 r10=00000205 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D8 r9=00000000 r10=00000206 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D9 r9=00000000 r10=00000207 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DA r9=00000000 r10=00000208 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DB r9=00000000 r10=00000209 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827ED1E4 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DC r9=00000000 r10=0000020A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DD r9=00000000 r10=0000020B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DE r9=00000000 r10=0000020C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DF r9=00000000 r10=0000020D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E0 r9=00000000 r10=0000020E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E1 r9=00000000 r10=0000020F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E2 r9=00000000 r10=00000210 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E3 r9=00000000 r10=00000211 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E4 r9=00000000 r10=00000212 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E5 r9=00000000 r10=00000213 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E6 r9=00000000 r10=00000214 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E7 r9=00000000 r10=00000215 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E8 r9=00000000 r10=00000216 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E9 r9=00000000 r10=00000217 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001EA r9=00000000 r10=00000218 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001EB r9=00000000 r10=00000219 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001EC r9=00000000 r10=0000021A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001ED r9=00000000 r10=0000021B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001EE r9=00000000 r10=0000021C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001EF r9=00000000 r10=0000021D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F0 r9=00000000 r10=0000021E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F1 r9=00000000 r10=0000021F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F2 r9=00000000 r10=00000220 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F3 r9=00000000 r10=00000221 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F4 r9=00000000 r10=00000222 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F5 r9=00000000 r10=00000223 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F6 r9=00000000 r10=00000224 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F7 r9=00000000 r10=00000225 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F8 r9=00000000 r10=00000226 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F9 r9=00000000 r10=00000227 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FA r9=00000000 r10=00000228 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FB r9=00000000 r10=00000229 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FC r9=00000000 r10=0000022A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FD r9=00000000 r10=0000022B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FE r9=00000000 r10=0000022C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FF r9=00000000 r10=0000022D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000200 r9=00000000 r10=0000022E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000201 r9=00000000 r10=0000022F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000202 r9=00000000 r10=00000230 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000203 r9=00000000 r10=00000231 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B2018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B2018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000110 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 guest_lr=82457F18 +K> F8000054 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B2018 prio=0 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000110 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000044 AUDIT-HLC NtSetEvent handle=F800010C lr=824AA304 guest_lr=82450DF4 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=300B0018 prio=0 lr=824AA304 +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B4 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000204 r9=00000000 r10=00000232 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F80000A8 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=8217B148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000084 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +F> F8000084 DiscImageDevice::ResolvePath(\dat) +K> F8000084 AUDIT-HLC NtDuplicateObject src=F80000C0 dst=F8000110 options=00000002 lr=824AA3B4 +K> F8000084 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 guest_lr=82460078 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000205 r9=00000000 r10=00000233 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000206 r9=00000000 r10=00000234 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000207 r9=00000000 r10=00000235 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000208 r9=00000000 r10=00000236 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000209 r9=00000000 r10=00000237 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000020A r9=00000000 r10=00000238 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C +K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 +K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000020B r9=00000000 r10=00000239 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D11A0 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D0978 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000020C r9=00000000 r10=0000023A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F80000A8 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=8217C6F4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000020D r9=00000000 r10=0000023B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000001 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000064 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=822F1FC8 +K> F8000064 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000114 kevent_va=30080018 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000118 kevent_va=300B0018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800011C kevent_va=300B2018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000120 kevent_va=300B4018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000124 kevent_va=300B6018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000128 kevent_va=300B8018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800012C kevent_va=300BA018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000134 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000134 kevent_va=300BC018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000138 kevent_va=300BE018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800013C kevent_va=300C0018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000140 kevent_va=300C2018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000144 kevent_va=300C4018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000148 kevent_va=300C6018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800014C kevent_va=300C8018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000150 kevent_va=300CA018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC ExCreateThread entry=82506528 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF8000154 (1B) Stack: 70880000-70890000 +K> F8000008 AUDIT-HLC ExCreateThread entry=82506558 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF8000158 (1C) Stack: 708B0000-708C0000 +K> F8000008 AUDIT-HLC ExCreateThread entry=82506588 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF800015C (1D) Stack: 708E0000-708F0000 +K> F8000008 AUDIT-HLC ExCreateThread entry=825065B8 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF8000160 (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D09C4 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D091C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 guest_lr=82172DF4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000010 r5=828F3888 r6=701CF924 r7=00000000 r8=0000020E r9=00000010 r10=0000024C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: 00000000 00000001 30057018 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25284 lr=82507ABC +K> F8000064 AUDIT-HLC silph_ctx_dump ctx_base=BCE251C0 (event BCE25284 at +C4) +K> F8000064 AUDIT-HLC DUMP BCE251C0: 8200A1E8 BCE251C0 BCE251C0 00000001 +K> F8000064 AUDIT-HLC DUMP BCE251D0: 01000000 00000000 3F7FCCCC 3F802D83 +K> F8000064 AUDIT-HLC DUMP BCE251E0: 00000000 00000001 30057018 BCE254C0 +K> F8000064 AUDIT-HLC DUMP BCE251F0: BE568F00 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25200: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25210: 00000000 01000000 00000000 BCE2521C +K> F8000064 AUDIT-HLC DUMP BCE25220: BCE2521C 01000000 00000000 BCE2522C +K> F8000064 AUDIT-HLC DUMP BCE25230: BCE2522C 01000000 00000000 BCE2523C +K> F8000064 AUDIT-HLC DUMP BCE25240: BCE2523C 01000000 00000000 BCE2524C +K> F8000064 AUDIT-HLC DUMP BCE25250: BCE2524C 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25260: F8000164 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25270: F8000168 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25280: F800016C 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25290: F8000170 00000001 00000001 00000005 +K> F8000064 AUDIT-HLC DUMP BCE252A0: 00000000 00000000 00000500 000002D0 +K> F8000064 AUDIT-HLC DUMP BCE252B0: 00000001 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE252C0: 00000000 00000000 F8000154 F8000158 +K> F8000064 AUDIT-HLC DUMP BCE252D0: F800015C F8000160 3F800000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE252E0: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE252F0: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25300: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25310: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25320: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25330: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25340: 820610E0 82061044 82061040 820610DC +K> F8000064 AUDIT-HLC DUMP BCE25350: BCD24B1C BCD24B1C 8206116C 3F800000 +K> F8000064 AUDIT-HLC DUMP BCE25360: 00000135 00000000 00000000 3F800000 +K> F8000064 AUDIT-HLC DUMP BCE25370: B2CBA5DD BC97CC40 BCD24B00 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25380: 00000000 0000FFFF 00000000 BCE25440 +K> F8000064 AUDIT-HLC DUMP BCE25390: BCE25394 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE253A0: 00000000 00000064 BCE25398 FFFFFFFF +K> F8000064 AUDIT-HLC DUMP BCE253B0: 00000135 BCE253A4 000000EB FFFFFFFF +K> F8000064 AUDIT-HLC DUMP BCE253C0: BCE253B0 00000000 00000000 BCE253BC +K> F8000064 AUDIT-HLC DUMP BCE253D0: 00000064 FFFFFFFF BCE253C8 0000014A +K> F8000064 AUDIT-HLC DUMP BCE253E0: 000000EF BCE253D4 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE253F0: BCE253E0 00000064 00000064 BCE253EC +K> F8000064 AUDIT-HLC DUMP BCE25400: 00000135 0000014A BCE253F8 20FFFFFF +K> F8000064 AUDIT-HLC DUMP BCE25410: 00000000 BCE25404 00000000 00000064 +K> F8000064 AUDIT-HLC DUMP BCE25420: BCE25410 FFFFFFFF 00000135 BCE2541C +K> F8000064 AUDIT-HLC DUMP BCE25430: 000000FF 00FFFFFF BCE25428 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25440: 00000000 BCE25434 00000064 BC97CC40 +K> F8000064 AUDIT-HLC DUMP BCE25450: 00000000 00000000 BCE2544C BCE2544C +K> F8000064 AUDIT-HLC DUMP BCE25460: 00000001 00000000 BCE24BC0 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25470: 00F10000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25480: 00000001 82060B14 BCD25000 BCD25100 +K> F8000064 AUDIT-HLC DUMP BCE25490: 00000000 02000000 BC22CB50 00000001 +K> F8000064 AUDIT-HLC DUMP BCE254A0: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE254B0: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC silph_ctx event-slots: +K> F8000064 AUDIT-HLC slot[0] off=+54 addr=BCE25214 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[1] off=+64 addr=BCE25224 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[2] off=+74 addr=BCE25234 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[3] off=+84 addr=BCE25244 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[4] off=+94 addr=BCE25254 hdr=00000000 state=00000001 +K> F8000064 AUDIT-HLC slot[5] off=+A4 addr=BCE25264 hdr=00000000 state=00000001 +K> F8000064 AUDIT-HLC slot[6] off=+B4 addr=BCE25274 hdr=00000000 state=00000001 +K> F8000064 AUDIT-HLC slot[7] off=+C4 addr=BCE25284 hdr=00000000 state=00000001 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000170 kevent_va=00000000 prio=1 lr=82507ABC +K> F8000154 XThread::Execute thid 27 (handle=F8000154, 'XThread021C (F8000154)', native=0000021C) +K> F8000154 AUDIT-HLC XThread::Execute tid=27 start_address=82506528 start_context=BCE251C0 xapi=824AFF88 +K> F8000158 XThread::Execute thid 28 (handle=F8000158, 'XThread0220 (F8000158)', native=00000220) +K> F8000158 AUDIT-HLC XThread::Execute tid=28 start_address=82506558 start_context=BCE251C0 xapi=824AFF88 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=0000000C r5=828F3888 r6=701CF924 r7=03A72328 r8=0000020F r9=00000010 r10=00000259 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800015C XThread::Execute thid 29 (handle=F800015C, 'XThread0224 (F800015C)', native=00000224) +K> F800015C AUDIT-HLC XThread::Execute tid=29 start_address=82506588 start_context=BCE251C0 xapi=824AFF88 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000006 r8=00000210 r9=00000010 r10=0000025A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000211 r9=00000010 r10=0000025B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: 00000000 00000001 30057018 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000002 r5=828F3888 r6=701CF924 r7=00000000 r8=00000212 r9=00000010 r10=0000025E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000002 r8=00000213 r9=00000010 r10=0000025F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000214 r9=00000010 r10=00000260 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: 00000000 00000001 30057018 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000215 r9=00000010 r10=00000261 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000216 r9=00000010 r10=00000262 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000217 r9=00000010 r10=00000263 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000218 r9=00000010 r10=00000264 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000219 r9=00000010 r10=00000265 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000021A r9=00000010 r10=00000266 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000021B r9=00000010 r10=00000267 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000021C r9=00000010 r10=00000268 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000021D r9=00000010 r10=00000269 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000021E r9=00000010 r10=0000026A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000021F r9=00000010 r10=0000026B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000220 r9=00000010 r10=0000026C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000221 r9=00000010 r10=0000026D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000222 r9=00000010 r10=0000026E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000223 r9=00000010 r10=0000026F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000224 r9=00000010 r10=00000270 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000225 r9=00000010 r10=00000271 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000226 r9=00000010 r10=00000272 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000227 r9=00000010 r10=00000273 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000228 r9=00000010 r10=00000274 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000229 r9=00000010 r10=00000275 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000022A r9=00000010 r10=00000276 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000022B r9=00000010 r10=00000277 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000022C r9=00000010 r10=00000278 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000022D r9=00000010 r10=00000279 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000022E r9=00000010 r10=0000027A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000022F r9=00000010 r10=0000027B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000230 r9=00000010 r10=0000027C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000231 r9=00000010 r10=0000027D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000232 r9=00000010 r10=0000027E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000233 r9=00000010 r10=0000027F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000234 r9=00000010 r10=00000280 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000235 r9=00000010 r10=00000281 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000236 r9=00000010 r10=00000282 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000237 r9=00000010 r10=00000283 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000238 r9=00000010 r10=00000284 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000239 r9=00000010 r10=00000285 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000023A r9=00000010 r10=00000286 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000023B r9=00000010 r10=00000287 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000023C r9=00000010 r10=00000288 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000023D r9=00000010 r10=00000289 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000023E r9=00000010 r10=0000028A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000023F r9=00000010 r10=0000028B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000240 r9=00000010 r10=0000028C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000241 r9=00000010 r10=0000028D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000242 r9=00000010 r10=0000028E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000243 r9=00000010 r10=0000028F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000244 r9=00000010 r10=00000290 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000245 r9=00000010 r10=00000291 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000246 r9=00000010 r10=00000292 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000247 r9=00000010 r10=00000293 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000248 r9=00000010 r10=00000294 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000249 r9=00000010 r10=00000295 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000024A r9=00000010 r10=00000296 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000024B r9=00000010 r10=00000297 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000024C r9=00000010 r10=00000298 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000024D r9=00000010 r10=00000299 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000024E r9=00000010 r10=0000029A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000024F r9=00000010 r10=0000029B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000250 r9=00000010 r10=0000029C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000251 r9=00000010 r10=0000029D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000252 r9=00000010 r10=0000029E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000253 r9=00000010 r10=0000029F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000254 r9=00000010 r10=000002A0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000255 r9=00000010 r10=000002A1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000256 r9=00000010 r10=000002A2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000257 r9=00000010 r10=000002A3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000258 r9=00000010 r10=000002A4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000259 r9=00000010 r10=000002A5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000025A r9=00000010 r10=000002A6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000025B r9=00000010 r10=000002A7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000025C r9=00000010 r10=000002A8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000025D r9=00000010 r10=000002A9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000025E r9=00000010 r10=000002AA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000025F r9=00000010 r10=000002AB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000260 r9=00000010 r10=000002AC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000261 r9=00000010 r10=000002AD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000262 r9=00000010 r10=000002AE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000263 r9=00000010 r10=000002AF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000264 r9=00000010 r10=000002B0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000265 r9=00000010 r10=000002B1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000266 r9=00000010 r10=000002B2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000267 r9=00000010 r10=000002B3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000268 r9=00000010 r10=000002B4 lr=822F1D5C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000269 r9=00000010 r10=000002B5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000026A r9=00000010 r10=000002B6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000026B r9=00000010 r10=000002B7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000026C r9=00000010 r10=000002B8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000026D r9=00000010 r10=000002B9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000026E r9=00000010 r10=000002BA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000026F r9=00000010 r10=000002BB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000270 r9=00000010 r10=000002BC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000271 r9=00000010 r10=000002BD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000272 r9=00000010 r10=000002BE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000273 r9=00000010 r10=000002BF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000274 r9=00000010 r10=000002C0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000275 r9=00000010 r10=000002C1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000276 r9=00000010 r10=000002C2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000277 r9=00000010 r10=000002C3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000278 r9=00000010 r10=000002C4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000279 r9=00000010 r10=000002C5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000027A r9=00000010 r10=000002C6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000027B r9=00000010 r10=000002C7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000027C r9=00000010 r10=000002C8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000027D r9=00000010 r10=000002C9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000027E r9=00000010 r10=000002CA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000027F r9=00000010 r10=000002CB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000280 r9=00000010 r10=000002CC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000281 r9=00000010 r10=000002CD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000282 r9=00000010 r10=000002CE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000283 r9=00000010 r10=000002CF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000284 r9=00000010 r10=000002D0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000285 r9=00000010 r10=000002D1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000286 r9=00000010 r10=000002D2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000287 r9=00000010 r10=000002D3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000288 r9=00000010 r10=000002D4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000289 r9=00000010 r10=000002D5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000028A r9=00000010 r10=000002D6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000028B r9=00000010 r10=000002D7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000028C r9=00000010 r10=000002D8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000028D r9=00000010 r10=000002D9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000028E r9=00000010 r10=000002DA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000028F r9=00000010 r10=000002DB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000290 r9=00000010 r10=000002DC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000291 r9=00000010 r10=000002DD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000292 r9=00000010 r10=000002DE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000293 r9=00000010 r10=000002DF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000294 r9=00000010 r10=000002E0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000295 r9=00000010 r10=000002E1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000296 r9=00000010 r10=000002E2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000297 r9=00000010 r10=000002E3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000298 r9=00000010 r10=000002E4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000299 r9=00000010 r10=000002E5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000029A r9=00000010 r10=000002E6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000029B r9=00000010 r10=000002E7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000029C r9=00000010 r10=000002E8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000029D r9=00000010 r10=000002E9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000029E r9=00000010 r10=000002EA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000029F r9=00000010 r10=000002EB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002A0 r9=00000010 r10=000002EC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002A1 r9=00000010 r10=000002ED lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002A2 r9=00000010 r10=000002EE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002A3 r9=00000010 r10=000002EF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002A4 r9=00000010 r10=000002F0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002A5 r9=00000010 r10=000002F1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002A6 r9=00000010 r10=000002F2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002A7 r9=00000010 r10=000002F3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002A8 r9=00000010 r10=000002F4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002A9 r9=00000010 r10=000002F5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002AA r9=00000010 r10=000002F6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002AB r9=00000010 r10=000002F7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002AC r9=00000010 r10=000002F8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002AD r9=00000010 r10=000002F9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002AE r9=00000010 r10=000002FA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002AF r9=00000010 r10=000002FB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002B0 r9=00000010 r10=000002FC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002B1 r9=00000010 r10=000002FD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002B2 r9=00000010 r10=000002FE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002B3 r9=00000010 r10=000002FF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002B4 r9=00000010 r10=00000300 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002B5 r9=00000010 r10=00000301 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002B6 r9=00000010 r10=00000302 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002B7 r9=00000010 r10=00000303 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002B8 r9=00000010 r10=00000304 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002B9 r9=00000010 r10=00000305 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002BA r9=00000010 r10=00000306 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002BB r9=00000010 r10=00000307 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002BC r9=00000010 r10=00000308 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002BD r9=00000010 r10=00000309 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002BE r9=00000010 r10=0000030A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002BF r9=00000010 r10=0000030B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002C0 r9=00000010 r10=0000030C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002C1 r9=00000010 r10=0000030D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002C2 r9=00000010 r10=0000030E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002C3 r9=00000010 r10=0000030F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002C4 r9=00000010 r10=00000310 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002C5 r9=00000010 r10=00000311 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002C6 r9=00000010 r10=00000312 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002C7 r9=00000010 r10=00000313 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002C8 r9=00000010 r10=00000314 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002C9 r9=00000010 r10=00000315 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002CA r9=00000010 r10=00000316 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002CB r9=00000010 r10=00000317 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002CC r9=00000010 r10=00000318 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002CD r9=00000010 r10=00000319 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002CE r9=00000010 r10=0000031A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002CF r9=00000010 r10=0000031B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002D0 r9=00000010 r10=0000031C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002D1 r9=00000010 r10=0000031D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002D2 r9=00000010 r10=0000031E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002D3 r9=00000010 r10=0000031F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002D4 r9=00000010 r10=00000320 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002D5 r9=00000010 r10=00000321 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002D6 r9=00000010 r10=00000322 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002D7 r9=00000010 r10=00000323 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002D8 r9=00000010 r10=00000324 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002D9 r9=00000010 r10=00000325 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002DA r9=00000010 r10=00000326 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002DB r9=00000010 r10=00000327 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002DC r9=00000010 r10=00000328 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002DD r9=00000010 r10=00000329 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002DE r9=00000010 r10=0000032A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002DF r9=00000010 r10=0000032B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002E0 r9=00000010 r10=0000032C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002E1 r9=00000010 r10=0000032D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002E2 r9=00000010 r10=0000032E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002E3 r9=00000010 r10=0000032F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002E4 r9=00000010 r10=00000330 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002E5 r9=00000010 r10=00000331 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002E6 r9=00000010 r10=00000332 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002E7 r9=00000010 r10=00000333 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002E8 r9=00000010 r10=00000334 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002E9 r9=00000010 r10=00000335 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002EA r9=00000010 r10=00000336 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002EB r9=00000010 r10=00000337 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002EC r9=00000010 r10=00000338 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002ED r9=00000010 r10=00000339 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002EE r9=00000010 r10=0000033A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002EF r9=00000010 r10=0000033B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002F0 r9=00000010 r10=0000033C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002F1 r9=00000010 r10=0000033D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002F2 r9=00000010 r10=0000033E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002F3 r9=00000010 r10=0000033F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002F4 r9=00000010 r10=00000340 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002F5 r9=00000010 r10=00000341 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002F6 r9=00000010 r10=00000342 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002F7 r9=00000010 r10=00000343 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002F8 r9=00000010 r10=00000344 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002F9 r9=00000010 r10=00000345 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002FA r9=00000010 r10=00000346 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002FB r9=00000010 r10=00000347 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002FC r9=00000010 r10=00000348 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002FD r9=00000010 r10=00000349 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002FE r9=00000010 r10=0000034A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002FF r9=00000010 r10=0000034B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000300 r9=00000010 r10=0000034C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000301 r9=00000010 r10=0000034D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000302 r9=00000010 r10=0000034E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000303 r9=00000010 r10=0000034F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000304 r9=00000010 r10=00000350 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000305 r9=00000010 r10=00000351 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000306 r9=00000010 r10=00000352 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000307 r9=00000010 r10=00000353 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000308 r9=00000010 r10=00000354 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000309 r9=00000010 r10=00000355 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000030A r9=00000010 r10=00000356 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000030B r9=00000010 r10=00000357 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000030C r9=00000010 r10=00000358 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000030D r9=00000010 r10=00000359 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000030E r9=00000010 r10=0000035A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000030F r9=00000010 r10=0000035B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000310 r9=00000010 r10=0000035C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000311 r9=00000010 r10=0000035D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000312 r9=00000010 r10=0000035E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000313 r9=00000010 r10=0000035F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000314 r9=00000010 r10=00000360 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000315 r9=00000010 r10=00000361 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000316 r9=00000010 r10=00000362 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000317 r9=00000010 r10=00000363 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000318 r9=00000010 r10=00000364 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000319 r9=00000010 r10=00000365 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000031A r9=00000010 r10=00000366 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000031B r9=00000010 r10=00000367 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000031C r9=00000010 r10=00000368 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000031D r9=00000010 r10=00000369 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000031E r9=00000010 r10=0000036A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000031F r9=00000010 r10=0000036B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000320 r9=00000010 r10=0000036C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000321 r9=00000010 r10=0000036D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000322 r9=00000010 r10=0000036E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000323 r9=00000010 r10=0000036F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000324 r9=00000010 r10=00000370 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000325 r9=00000010 r10=00000371 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000326 r9=00000010 r10=00000372 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000327 r9=00000010 r10=00000373 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000328 r9=00000010 r10=00000374 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000329 r9=00000010 r10=00000375 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000032A r9=00000010 r10=00000376 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000032B r9=00000010 r10=00000377 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000032C r9=00000010 r10=00000378 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000032D r9=00000010 r10=00000379 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000032E r9=00000010 r10=0000037A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000032F r9=00000010 r10=0000037B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000330 r9=00000010 r10=0000037C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000331 r9=00000010 r10=0000037D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000332 r9=00000010 r10=0000037E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000333 r9=00000010 r10=0000037F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000334 r9=00000010 r10=00000380 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000335 r9=00000010 r10=00000381 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000336 r9=00000010 r10=00000382 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000337 r9=00000010 r10=00000383 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000338 r9=00000010 r10=00000384 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000339 r9=00000010 r10=00000385 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000033A r9=00000010 r10=00000386 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D0868 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000033B r9=00000010 r10=00000387 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000033C r9=00000010 r10=00000388 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000033D r9=00000010 r10=00000389 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000033E r9=00000010 r10=0000038A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000033F r9=00000010 r10=0000038B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000340 r9=00000010 r10=0000038C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000341 r9=00000010 r10=0000038D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000342 r9=00000010 r10=0000038E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000343 r9=00000010 r10=0000038F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000344 r9=00000010 r10=00000390 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000345 r9=00000010 r10=00000391 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000346 r9=00000010 r10=00000392 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000347 r9=00000010 r10=00000393 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000348 r9=00000010 r10=00000394 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000349 r9=00000010 r10=00000395 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000034A r9=00000010 r10=00000396 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000034B r9=00000010 r10=00000397 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000034C r9=00000010 r10=00000398 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000034D r9=00000010 r10=00000399 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000034E r9=00000010 r10=0000039A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000034F r9=00000010 r10=0000039B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000350 r9=00000010 r10=0000039C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000351 r9=00000010 r10=0000039D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000352 r9=00000010 r10=0000039E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000353 r9=00000010 r10=0000039F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000354 r9=00000010 r10=000003A0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000355 r9=00000010 r10=000003A1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000356 r9=00000010 r10=000003A2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000357 r9=00000010 r10=000003A3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000358 r9=00000010 r10=000003A4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000359 r9=00000010 r10=000003A5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000035A r9=00000010 r10=000003A6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000035B r9=00000010 r10=000003A7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000035C r9=00000010 r10=000003A8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000035D r9=00000010 r10=000003A9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000035E r9=00000010 r10=000003AA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000035F r9=00000010 r10=000003AB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000360 r9=00000010 r10=000003AC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000361 r9=00000010 r10=000003AD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000362 r9=00000010 r10=000003AE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000363 r9=00000010 r10=000003AF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000364 r9=00000010 r10=000003B0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000365 r9=00000010 r10=000003B1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000366 r9=00000010 r10=000003B2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000367 r9=00000010 r10=000003B3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000368 r9=00000010 r10=000003B4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000369 r9=00000010 r10=000003B5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000036A r9=00000010 r10=000003B6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000036B r9=00000010 r10=000003B7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000036C r9=00000010 r10=000003B8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000036D r9=00000010 r10=000003B9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000036E r9=00000010 r10=000003BA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000036F r9=00000010 r10=000003BB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000370 r9=00000010 r10=000003BC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000371 r9=00000010 r10=000003BD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000372 r9=00000010 r10=000003BE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000373 r9=00000010 r10=000003BF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000374 r9=00000010 r10=000003C0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000375 r9=00000010 r10=000003C1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000376 r9=00000010 r10=000003C2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000377 r9=00000010 r10=000003C3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000378 r9=00000010 r10=000003C4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000379 r9=00000010 r10=000003C5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000037A r9=00000010 r10=000003C6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000037B r9=00000010 r10=000003C7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000037C r9=00000010 r10=000003C8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000037D r9=00000010 r10=000003C9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000037E r9=00000010 r10=000003CA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000037F r9=00000010 r10=000003CB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000380 r9=00000010 r10=000003CC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000381 r9=00000010 r10=000003CD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000382 r9=00000010 r10=000003CE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000383 r9=00000010 r10=000003CF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000384 r9=00000010 r10=000003D0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000385 r9=00000010 r10=000003D1 lr=822F1D5C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000386 r9=00000010 r10=000003D2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000387 r9=00000010 r10=000003D3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000388 r9=00000010 r10=000003D4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000389 r9=00000010 r10=000003D5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000038A r9=00000010 r10=000003D6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000038B r9=00000010 r10=000003D7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000038C r9=00000010 r10=000003D8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000038D r9=00000010 r10=000003D9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000038E r9=00000010 r10=000003DA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000038F r9=00000010 r10=000003DB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000390 r9=00000010 r10=000003DC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000391 r9=00000010 r10=000003DD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000392 r9=00000010 r10=000003DE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000393 r9=00000010 r10=000003DF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000394 r9=00000010 r10=000003E0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000395 r9=00000010 r10=000003E1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000396 r9=00000010 r10=000003E2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000397 r9=00000010 r10=000003E3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000398 r9=00000010 r10=000003E4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000399 r9=00000010 r10=000003E5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000039A r9=00000010 r10=000003E6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000039B r9=00000010 r10=000003E7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000039C r9=00000010 r10=000003E8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000039D r9=00000010 r10=000003E9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000039E r9=00000010 r10=000003EA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000039F r9=00000010 r10=000003EB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003A0 r9=00000010 r10=000003EC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003A1 r9=00000010 r10=000003ED lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003A2 r9=00000010 r10=000003EE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003A3 r9=00000010 r10=000003EF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003A4 r9=00000010 r10=000003F0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003A5 r9=00000010 r10=000003F1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003A6 r9=00000010 r10=000003F2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003A7 r9=00000010 r10=000003F3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003A8 r9=00000010 r10=000003F4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003A9 r9=00000010 r10=000003F5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E9C9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003AA r9=00000010 r10=000003F6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003AB r9=00000010 r10=000003F7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003AC r9=00000010 r10=000003F8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003AD r9=00000010 r10=000003F9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003AE r9=00000010 r10=000003FA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003AF r9=00000010 r10=000003FB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003B0 r9=00000010 r10=000003FC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003B1 r9=00000010 r10=000003FD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003B2 r9=00000010 r10=000003FE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003B3 r9=00000010 r10=000003FF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003B4 r9=00000010 r10=00000400 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003B5 r9=00000010 r10=00000401 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003B6 r9=00000010 r10=00000402 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003B7 r9=00000010 r10=00000403 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003B8 r9=00000010 r10=00000404 lr=822F1D5C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003B9 r9=00000010 r10=00000405 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003BA r9=00000010 r10=00000406 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003BB r9=00000010 r10=00000407 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003BC r9=00000010 r10=00000408 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003BD r9=00000010 r10=00000409 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003BE r9=00000010 r10=0000040A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003BF r9=00000010 r10=0000040B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003C0 r9=00000010 r10=0000040C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003C1 r9=00000010 r10=0000040D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003C2 r9=00000010 r10=0000040E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003C3 r9=00000010 r10=0000040F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003C4 r9=00000010 r10=00000410 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003C5 r9=00000010 r10=00000411 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003C6 r9=00000010 r10=00000412 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003C7 r9=00000010 r10=00000413 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003C8 r9=00000010 r10=00000414 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003C9 r9=00000010 r10=00000415 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003CA r9=00000010 r10=00000416 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003CB r9=00000010 r10=00000417 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003CC r9=00000010 r10=00000418 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003CD r9=00000010 r10=00000419 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003CE r9=00000010 r10=0000041A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003CF r9=00000010 r10=0000041B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003D0 r9=00000010 r10=0000041C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003D1 r9=00000010 r10=0000041D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003D2 r9=00000010 r10=0000041E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003D3 r9=00000010 r10=0000041F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003D4 r9=00000010 r10=00000420 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003D5 r9=00000010 r10=00000421 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003D6 r9=00000010 r10=00000422 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003D7 r9=00000010 r10=00000423 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003D8 r9=00000010 r10=00000424 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003D9 r9=00000010 r10=00000425 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003DA r9=00000010 r10=00000426 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003DB r9=00000010 r10=00000427 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003DC r9=00000010 r10=00000428 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003DD r9=00000010 r10=00000429 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003DE r9=00000010 r10=0000042A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003DF r9=00000010 r10=0000042B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003E0 r9=00000010 r10=0000042C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003E1 r9=00000010 r10=0000042D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003E2 r9=00000010 r10=0000042E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003E3 r9=00000010 r10=0000042F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003E4 r9=00000010 r10=00000430 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003E5 r9=00000010 r10=00000431 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003E6 r9=00000010 r10=00000432 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003E7 r9=00000010 r10=00000433 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003E8 r9=00000010 r10=00000434 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003E9 r9=00000010 r10=00000435 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003EA r9=00000010 r10=00000436 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003EB r9=00000010 r10=00000437 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003EC r9=00000010 r10=00000438 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003ED r9=00000010 r10=00000439 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003EE r9=00000010 r10=0000043A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003EF r9=00000010 r10=0000043B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003F0 r9=00000010 r10=0000043C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003F1 r9=00000010 r10=0000043D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003F2 r9=00000010 r10=0000043E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003F3 r9=00000010 r10=0000043F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003F4 r9=00000010 r10=00000440 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003F5 r9=00000010 r10=00000441 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003F6 r9=00000010 r10=00000442 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003F7 r9=00000010 r10=00000443 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003F8 r9=00000010 r10=00000444 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003F9 r9=00000010 r10=00000445 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003FA r9=00000010 r10=00000446 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003FB r9=00000010 r10=00000447 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003FC r9=00000010 r10=00000448 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003FD r9=00000010 r10=00000449 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003FE r9=00000010 r10=0000044A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003FF r9=00000010 r10=0000044B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000400 r9=00000010 r10=0000044C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000401 r9=00000010 r10=0000044D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000402 r9=00000010 r10=0000044E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000403 r9=00000010 r10=0000044F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000404 r9=00000010 r10=00000450 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000405 r9=00000010 r10=00000451 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000406 r9=00000010 r10=00000452 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000407 r9=00000010 r10=00000453 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000408 r9=00000010 r10=00000454 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000409 r9=00000010 r10=00000455 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000040A r9=00000010 r10=00000456 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000040B r9=00000010 r10=00000457 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000040C r9=00000010 r10=00000458 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000040D r9=00000010 r10=00000459 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000040E r9=00000010 r10=0000045A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000040F r9=00000010 r10=0000045B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000410 r9=00000010 r10=0000045C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000411 r9=00000010 r10=0000045D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000412 r9=00000010 r10=0000045E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000413 r9=00000010 r10=0000045F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000414 r9=00000010 r10=00000460 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000415 r9=00000010 r10=00000461 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000416 r9=00000010 r10=00000462 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000417 r9=00000010 r10=00000463 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000418 r9=00000010 r10=00000464 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000419 r9=00000010 r10=00000465 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000041A r9=00000010 r10=00000466 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000041B r9=00000010 r10=00000467 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000041C r9=00000010 r10=00000468 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000041D r9=00000010 r10=00000469 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000041E r9=00000010 r10=0000046A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000041F r9=00000010 r10=0000046B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000420 r9=00000010 r10=0000046C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000421 r9=00000010 r10=0000046D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000422 r9=00000010 r10=0000046E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000423 r9=00000010 r10=0000046F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000424 r9=00000010 r10=00000470 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000425 r9=00000010 r10=00000471 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000426 r9=00000010 r10=00000472 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000427 r9=00000010 r10=00000473 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000428 r9=00000010 r10=00000474 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000429 r9=00000010 r10=00000475 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000042A r9=00000010 r10=00000476 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000042B r9=00000010 r10=00000477 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000042C r9=00000010 r10=00000478 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000042D r9=00000010 r10=00000479 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000042E r9=00000010 r10=0000047A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000042F r9=00000010 r10=0000047B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000430 r9=00000010 r10=0000047C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000431 r9=00000010 r10=0000047D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000432 r9=00000010 r10=0000047E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000433 r9=00000010 r10=0000047F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000434 r9=00000010 r10=00000480 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000435 r9=00000010 r10=00000481 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000436 r9=00000010 r10=00000482 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000437 r9=00000010 r10=00000483 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000438 r9=00000010 r10=00000484 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000439 r9=00000010 r10=00000485 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000043A r9=00000010 r10=00000486 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000043B r9=00000010 r10=00000487 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000043C r9=00000010 r10=00000488 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000043D r9=00000010 r10=00000489 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000043E r9=00000010 r10=0000048A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000043F r9=00000010 r10=0000048B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000440 r9=00000010 r10=0000048C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000441 r9=00000010 r10=0000048D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000442 r9=00000010 r10=0000048E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000443 r9=00000010 r10=0000048F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000444 r9=00000010 r10=00000490 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000445 r9=00000010 r10=00000491 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000446 r9=00000010 r10=00000492 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000447 r9=00000010 r10=00000493 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000448 r9=00000010 r10=00000494 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000449 r9=00000010 r10=00000495 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000044A r9=00000010 r10=00000496 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000044B r9=00000010 r10=00000497 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000044C r9=00000010 r10=00000498 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000044D r9=00000010 r10=00000499 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000044E r9=00000010 r10=0000049A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000044F r9=00000010 r10=0000049B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000450 r9=00000010 r10=0000049C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000451 r9=00000010 r10=0000049D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000452 r9=00000010 r10=0000049E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000453 r9=00000010 r10=0000049F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000454 r9=00000010 r10=000004A0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000455 r9=00000010 r10=000004A1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000456 r9=00000010 r10=000004A2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000457 r9=00000010 r10=000004A3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000458 r9=00000010 r10=000004A4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000459 r9=00000010 r10=000004A5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000045A r9=00000010 r10=000004A6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000045B r9=00000010 r10=000004A7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000045C r9=00000010 r10=000004A8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000045D r9=00000010 r10=000004A9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000045E r9=00000010 r10=000004AA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000045F r9=00000010 r10=000004AB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000460 r9=00000010 r10=000004AC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000461 r9=00000010 r10=000004AD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000462 r9=00000010 r10=000004AE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000463 r9=00000010 r10=000004AF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000464 r9=00000010 r10=000004B0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000465 r9=00000010 r10=000004B1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000466 r9=00000010 r10=000004B2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000467 r9=00000010 r10=000004B3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000468 r9=00000010 r10=000004B4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000469 r9=00000010 r10=000004B5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000046A r9=00000010 r10=000004B6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000046B r9=00000010 r10=000004B7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000046C r9=00000010 r10=000004B8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000046D r9=00000010 r10=000004B9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000046E r9=00000010 r10=000004BA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000046F r9=00000010 r10=000004BB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000470 r9=00000010 r10=000004BC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000471 r9=00000010 r10=000004BD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000472 r9=00000010 r10=000004BE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000473 r9=00000010 r10=000004BF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000474 r9=00000010 r10=000004C0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000475 r9=00000010 r10=000004C1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000476 r9=00000010 r10=000004C2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000477 r9=00000010 r10=000004C3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000478 r9=00000010 r10=000004C4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000479 r9=00000010 r10=000004C5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000047A r9=00000010 r10=000004C6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000047B r9=00000010 r10=000004C7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000047C r9=00000010 r10=000004C8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000047D r9=00000010 r10=000004C9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000047E r9=00000010 r10=000004CA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000047F r9=00000010 r10=000004CB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000480 r9=00000010 r10=000004CC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000481 r9=00000010 r10=000004CD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000482 r9=00000010 r10=000004CE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000483 r9=00000010 r10=000004CF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000484 r9=00000010 r10=000004D0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000485 r9=00000010 r10=000004D1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000486 r9=00000010 r10=000004D2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000487 r9=00000010 r10=000004D3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000488 r9=00000010 r10=000004D4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000489 r9=00000010 r10=000004D5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000048A r9=00000010 r10=000004D6 lr=822F1D5C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000048B r9=00000010 r10=000004D7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000048C r9=00000010 r10=000004D8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000048D r9=00000010 r10=000004D9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000048E r9=00000010 r10=000004DA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000048F r9=00000010 r10=000004DB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000490 r9=00000010 r10=000004DC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000491 r9=00000010 r10=000004DD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000492 r9=00000010 r10=000004DE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000493 r9=00000010 r10=000004DF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000494 r9=00000010 r10=000004E0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000495 r9=00000010 r10=000004E1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000496 r9=00000010 r10=000004E2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000497 r9=00000010 r10=000004E3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000498 r9=00000010 r10=000004E4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000499 r9=00000010 r10=000004E5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000049A r9=00000010 r10=000004E6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000049B r9=00000010 r10=000004E7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000049C r9=00000010 r10=000004E8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000049D r9=00000010 r10=000004E9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000049E r9=00000010 r10=000004EA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000049F r9=00000010 r10=000004EB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004A0 r9=00000010 r10=000004EC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004A1 r9=00000010 r10=000004ED lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004A2 r9=00000010 r10=000004EE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004A3 r9=00000010 r10=000004EF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004A4 r9=00000010 r10=000004F0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004A5 r9=00000010 r10=000004F1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004A6 r9=00000010 r10=000004F2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004A7 r9=00000010 r10=000004F3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004A8 r9=00000010 r10=000004F4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004A9 r9=00000010 r10=000004F5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004AA r9=00000010 r10=000004F6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004AB r9=00000010 r10=000004F7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004AC r9=00000010 r10=000004F8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004AD r9=00000010 r10=000004F9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004AE r9=00000010 r10=000004FA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004AF r9=00000010 r10=000004FB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004B0 r9=00000010 r10=000004FC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004B1 r9=00000010 r10=000004FD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004B2 r9=00000010 r10=000004FE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004B3 r9=00000010 r10=000004FF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004B4 r9=00000010 r10=00000500 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004B5 r9=00000010 r10=00000501 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004B6 r9=00000010 r10=00000502 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004B7 r9=00000010 r10=00000503 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004B8 r9=00000010 r10=00000504 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004B9 r9=00000010 r10=00000505 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004BA r9=00000010 r10=00000506 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004BB r9=00000010 r10=00000507 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004BC r9=00000010 r10=00000508 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004BD r9=00000010 r10=00000509 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004BE r9=00000010 r10=0000050A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004BF r9=00000010 r10=0000050B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004C0 r9=00000010 r10=0000050C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004C1 r9=00000010 r10=0000050D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004C2 r9=00000010 r10=0000050E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004C3 r9=00000010 r10=0000050F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004C4 r9=00000010 r10=00000510 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004C5 r9=00000010 r10=00000511 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004C6 r9=00000010 r10=00000512 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004C7 r9=00000010 r10=00000513 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004C8 r9=00000010 r10=00000514 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004C9 r9=00000010 r10=00000515 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004CA r9=00000010 r10=00000516 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004CB r9=00000010 r10=00000517 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004CC r9=00000010 r10=00000518 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004CD r9=00000010 r10=00000519 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004CE r9=00000010 r10=0000051A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004CF r9=00000010 r10=0000051B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004D0 r9=00000010 r10=0000051C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004D1 r9=00000010 r10=0000051D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004D2 r9=00000010 r10=0000051E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004D3 r9=00000010 r10=0000051F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004D4 r9=00000010 r10=00000520 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004D5 r9=00000010 r10=00000521 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004D6 r9=00000010 r10=00000522 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004D7 r9=00000010 r10=00000523 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004D8 r9=00000010 r10=00000524 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004D9 r9=00000010 r10=00000525 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004DA r9=00000010 r10=00000526 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004DB r9=00000010 r10=00000527 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004DC r9=00000010 r10=00000528 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004DD r9=00000010 r10=00000529 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004DE r9=00000010 r10=0000052A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004DF r9=00000010 r10=0000052B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004E0 r9=00000010 r10=0000052C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004E1 r9=00000010 r10=0000052D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004E2 r9=00000010 r10=0000052E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004E3 r9=00000010 r10=0000052F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004E4 r9=00000010 r10=00000530 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004E5 r9=00000010 r10=00000531 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004E6 r9=00000010 r10=00000532 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004E7 r9=00000010 r10=00000533 lr=822F1D5C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004E8 r9=00000010 r10=00000534 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004E9 r9=00000010 r10=00000535 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004EA r9=00000010 r10=00000536 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004EB r9=00000010 r10=00000537 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004EC r9=00000010 r10=00000538 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004ED r9=00000010 r10=00000539 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004EE r9=00000010 r10=0000053A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004EF r9=00000010 r10=0000053B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004F0 r9=00000010 r10=0000053C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004F1 r9=00000010 r10=0000053D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004F2 r9=00000010 r10=0000053E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004F3 r9=00000010 r10=0000053F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004F4 r9=00000010 r10=00000540 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004F5 r9=00000010 r10=00000541 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004F6 r9=00000010 r10=00000542 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004F7 r9=00000010 r10=00000543 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004F8 r9=00000010 r10=00000544 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004F9 r9=00000010 r10=00000545 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004FA r9=00000010 r10=00000546 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004FB r9=00000010 r10=00000547 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004FC r9=00000010 r10=00000548 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004FD r9=00000010 r10=00000549 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004FE r9=00000010 r10=0000054A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004FF r9=00000010 r10=0000054B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000500 r9=00000010 r10=0000054C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000501 r9=00000010 r10=0000054D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000502 r9=00000010 r10=0000054E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000503 r9=00000010 r10=0000054F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000504 r9=00000010 r10=00000550 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000505 r9=00000010 r10=00000551 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000506 r9=00000010 r10=00000552 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000507 r9=00000010 r10=00000553 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000508 r9=00000010 r10=00000554 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000509 r9=00000010 r10=00000555 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000050A r9=00000010 r10=00000556 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000050B r9=00000010 r10=00000557 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000050C r9=00000010 r10=00000558 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000050D r9=00000010 r10=00000559 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000050E r9=00000010 r10=0000055A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000050F r9=00000010 r10=0000055B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000510 r9=00000010 r10=0000055C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000511 r9=00000010 r10=0000055D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000512 r9=00000010 r10=0000055E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000513 r9=00000010 r10=0000055F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000514 r9=00000010 r10=00000560 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000515 r9=00000010 r10=00000561 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000516 r9=00000010 r10=00000562 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000517 r9=00000010 r10=00000563 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000518 r9=00000010 r10=00000564 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000519 r9=00000010 r10=00000565 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000051A r9=00000010 r10=00000566 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000051B r9=00000010 r10=00000567 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000051C r9=00000010 r10=00000568 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000051D r9=00000010 r10=00000569 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000051E r9=00000010 r10=0000056A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000051F r9=00000010 r10=0000056B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000520 r9=00000010 r10=0000056C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000521 r9=00000010 r10=0000056D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000522 r9=00000010 r10=0000056E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000523 r9=00000010 r10=0000056F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000524 r9=00000010 r10=00000570 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000525 r9=00000010 r10=00000571 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000526 r9=00000010 r10=00000572 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000527 r9=00000010 r10=00000573 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000528 r9=00000010 r10=00000574 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000529 r9=00000010 r10=00000575 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000052A r9=00000010 r10=00000576 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000052B r9=00000010 r10=00000577 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000052C r9=00000010 r10=00000578 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000052D r9=00000010 r10=00000579 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000052E r9=00000010 r10=0000057A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000052F r9=00000010 r10=0000057B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000530 r9=00000010 r10=0000057C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000531 r9=00000010 r10=0000057D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000532 r9=00000010 r10=0000057E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000533 r9=00000010 r10=0000057F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000534 r9=00000010 r10=00000580 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000535 r9=00000010 r10=00000581 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000536 r9=00000010 r10=00000582 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000537 r9=00000010 r10=00000583 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000538 r9=00000010 r10=00000584 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000539 r9=00000010 r10=00000585 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000053A r9=00000010 r10=00000586 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000053B r9=00000010 r10=00000587 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000053C r9=00000010 r10=00000588 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000053D r9=00000010 r10=00000589 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000053E r9=00000010 r10=0000058A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000053F r9=00000010 r10=0000058B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000540 r9=00000010 r10=0000058C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000541 r9=00000010 r10=0000058D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000542 r9=00000010 r10=0000058E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000543 r9=00000010 r10=0000058F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000544 r9=00000010 r10=00000590 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000545 r9=00000010 r10=00000591 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000546 r9=00000010 r10=00000592 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000547 r9=00000010 r10=00000593 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000548 r9=00000010 r10=00000594 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000549 r9=00000010 r10=00000595 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000054A r9=00000010 r10=00000596 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000054B r9=00000010 r10=00000597 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000054C r9=00000010 r10=00000598 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000054D r9=00000010 r10=00000599 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000054E r9=00000010 r10=0000059A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000054F r9=00000010 r10=0000059B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000550 r9=00000010 r10=0000059C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000551 r9=00000010 r10=0000059D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000552 r9=00000010 r10=0000059E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000553 r9=00000010 r10=0000059F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000554 r9=00000010 r10=000005A0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000555 r9=00000010 r10=000005A1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000556 r9=00000010 r10=000005A2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000557 r9=00000010 r10=000005A3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000558 r9=00000010 r10=000005A4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000559 r9=00000010 r10=000005A5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000055A r9=00000010 r10=000005A6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000055B r9=00000010 r10=000005A7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000055C r9=00000010 r10=000005A8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000055D r9=00000010 r10=000005A9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000055E r9=00000010 r10=000005AA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000055F r9=00000010 r10=000005AB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000560 r9=00000010 r10=000005AC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000561 r9=00000010 r10=000005AD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000562 r9=00000010 r10=000005AE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000563 r9=00000010 r10=000005AF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000564 r9=00000010 r10=000005B0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000565 r9=00000010 r10=000005B1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000566 r9=00000010 r10=000005B2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000567 r9=00000010 r10=000005B3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000568 r9=00000010 r10=000005B4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000001 r5=828F3888 r6=701CF924 r7=00000001 r8=00000569 r9=00000010 r10=000005B6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000056A r9=00000010 r10=000005B7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000056B r9=00000010 r10=000005B8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000056C r9=00000010 r10=000005B9 lr=822F1D5C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000056D r9=00000010 r10=000005BA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000056E r9=00000010 r10=000005BB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000056F r9=00000010 r10=000005BC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000570 r9=00000010 r10=000005BD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000571 r9=00000010 r10=000005BE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000572 r9=00000010 r10=000005BF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000573 r9=00000010 r10=000005C0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000574 r9=00000010 r10=000005C1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000575 r9=00000010 r10=000005C2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000576 r9=00000010 r10=000005C3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000577 r9=00000010 r10=000005C4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000578 r9=00000010 r10=000005C5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000579 r9=00000010 r10=000005C6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000057A r9=00000010 r10=000005C7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000057B r9=00000010 r10=000005C8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000057C r9=00000010 r10=000005C9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000057D r9=00000010 r10=000005CA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000057E r9=00000010 r10=000005CB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000057F r9=00000010 r10=000005CC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000580 r9=00000010 r10=000005CD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000581 r9=00000010 r10=000005CE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000582 r9=00000010 r10=000005CF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000583 r9=00000010 r10=000005D0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000584 r9=00000010 r10=000005D1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000585 r9=00000010 r10=000005D2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000586 r9=00000010 r10=000005D3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000587 r9=00000010 r10=000005D4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000588 r9=00000010 r10=000005D5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000589 r9=00000010 r10=000005D6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000058A r9=00000010 r10=000005D7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000058B r9=00000010 r10=000005D8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000058C r9=00000010 r10=000005D9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000058D r9=00000010 r10=000005DA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000058E r9=00000010 r10=000005DB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000058F r9=00000010 r10=000005DC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000590 r9=00000010 r10=000005DD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000591 r9=00000010 r10=000005DE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000592 r9=00000010 r10=000005DF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000593 r9=00000010 r10=000005E0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000594 r9=00000010 r10=000005E1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000595 r9=00000010 r10=000005E2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000596 r9=00000010 r10=000005E3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000597 r9=00000010 r10=000005E4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000598 r9=00000010 r10=000005E5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000599 r9=00000010 r10=000005E6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000059A r9=00000010 r10=000005E7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000059B r9=00000010 r10=000005E8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000059C r9=00000010 r10=000005E9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000059D r9=00000010 r10=000005EA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000059E r9=00000010 r10=000005EB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000059F r9=00000010 r10=000005EC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005A0 r9=00000010 r10=000005ED lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005A1 r9=00000010 r10=000005EE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005A2 r9=00000010 r10=000005EF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005A3 r9=00000010 r10=000005F0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005A4 r9=00000010 r10=000005F1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005A5 r9=00000010 r10=000005F2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005A6 r9=00000010 r10=000005F3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005A7 r9=00000010 r10=000005F4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005A8 r9=00000010 r10=000005F5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005A9 r9=00000010 r10=000005F6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005AA r9=00000010 r10=000005F7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005AB r9=00000010 r10=000005F8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005AC r9=00000010 r10=000005F9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005AD r9=00000010 r10=000005FA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005AE r9=00000010 r10=000005FB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005AF r9=00000010 r10=000005FC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005B0 r9=00000010 r10=000005FD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005B1 r9=00000010 r10=000005FE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005B2 r9=00000010 r10=000005FF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005B3 r9=00000010 r10=00000600 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005B4 r9=00000010 r10=00000601 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005B5 r9=00000010 r10=00000602 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005B6 r9=00000010 r10=00000603 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005B7 r9=00000010 r10=00000604 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005B8 r9=00000010 r10=00000605 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005B9 r9=00000010 r10=00000606 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005BA r9=00000010 r10=00000607 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005BB r9=00000010 r10=00000608 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005BC r9=00000010 r10=00000609 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005BD r9=00000010 r10=0000060A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005BE r9=00000010 r10=0000060B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005BF r9=00000010 r10=0000060C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005C0 r9=00000010 r10=0000060D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005C1 r9=00000010 r10=0000060E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005C2 r9=00000010 r10=0000060F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005C3 r9=00000010 r10=00000610 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005C4 r9=00000010 r10=00000611 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005C5 r9=00000010 r10=00000612 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005C6 r9=00000010 r10=00000613 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005C7 r9=00000010 r10=00000614 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005C8 r9=00000010 r10=00000615 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005C9 r9=00000010 r10=00000616 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005CA r9=00000010 r10=00000617 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005CB r9=00000010 r10=00000618 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005CC r9=00000010 r10=00000619 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005CD r9=00000010 r10=0000061A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005CE r9=00000010 r10=0000061B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005CF r9=00000010 r10=0000061C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005D0 r9=00000010 r10=0000061D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005D1 r9=00000010 r10=0000061E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005D2 r9=00000010 r10=0000061F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005D3 r9=00000010 r10=00000620 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005D4 r9=00000010 r10=00000621 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005D5 r9=00000010 r10=00000622 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005D6 r9=00000010 r10=00000623 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005D7 r9=00000010 r10=00000624 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005D8 r9=00000010 r10=00000625 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005D9 r9=00000010 r10=00000626 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005DA r9=00000010 r10=00000627 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005DB r9=00000010 r10=00000628 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005DC r9=00000010 r10=00000629 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005DD r9=00000010 r10=0000062A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005DE r9=00000010 r10=0000062B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005DF r9=00000010 r10=0000062C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005E0 r9=00000010 r10=0000062D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005E1 r9=00000010 r10=0000062E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005E2 r9=00000010 r10=0000062F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005E3 r9=00000010 r10=00000630 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005E4 r9=00000010 r10=00000631 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005E5 r9=00000010 r10=00000632 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005E6 r9=00000010 r10=00000633 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005E7 r9=00000010 r10=00000634 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005E8 r9=00000010 r10=00000635 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005E9 r9=00000010 r10=00000636 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005EA r9=00000010 r10=00000637 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005EB r9=00000010 r10=00000638 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005EC r9=00000010 r10=00000639 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005ED r9=00000010 r10=0000063A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005EE r9=00000010 r10=0000063B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005EF r9=00000010 r10=0000063C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005F0 r9=00000010 r10=0000063D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005F1 r9=00000010 r10=0000063E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005F2 r9=00000010 r10=0000063F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005F3 r9=00000010 r10=00000640 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005F4 r9=00000010 r10=00000641 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005F5 r9=00000010 r10=00000642 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005F6 r9=00000010 r10=00000643 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005F7 r9=00000010 r10=00000644 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005F8 r9=00000010 r10=00000645 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005F9 r9=00000010 r10=00000646 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005FA r9=00000010 r10=00000647 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005FB r9=00000010 r10=00000648 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005FC r9=00000010 r10=00000649 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005FD r9=00000010 r10=0000064A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005FE r9=00000010 r10=0000064B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005FF r9=00000010 r10=0000064C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000600 r9=00000010 r10=0000064D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000601 r9=00000010 r10=0000064E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000602 r9=00000010 r10=0000064F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000603 r9=00000010 r10=00000650 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000604 r9=00000010 r10=00000651 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000605 r9=00000010 r10=00000652 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000606 r9=00000010 r10=00000653 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000607 r9=00000010 r10=00000654 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000608 r9=00000010 r10=00000655 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000609 r9=00000010 r10=00000656 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000060A r9=00000010 r10=00000657 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000060B r9=00000010 r10=00000658 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000060C r9=00000010 r10=00000659 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000060D r9=00000010 r10=0000065A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000060E r9=00000010 r10=0000065B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000060F r9=00000010 r10=0000065C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000610 r9=00000010 r10=0000065D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000611 r9=00000010 r10=0000065E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000612 r9=00000010 r10=0000065F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000613 r9=00000010 r10=00000660 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000614 r9=00000010 r10=00000661 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000615 r9=00000010 r10=00000662 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000616 r9=00000010 r10=00000663 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000617 r9=00000010 r10=00000664 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000618 r9=00000010 r10=00000665 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000619 r9=00000010 r10=00000666 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000061A r9=00000010 r10=00000667 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000061B r9=00000010 r10=00000668 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000061C r9=00000010 r10=00000669 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000061D r9=00000010 r10=0000066A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000061E r9=00000010 r10=0000066B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000061F r9=00000010 r10=0000066C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000620 r9=00000010 r10=0000066D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000621 r9=00000010 r10=0000066E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000622 r9=00000010 r10=0000066F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000623 r9=00000010 r10=00000670 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D0C6C +K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000624 r9=00000010 r10=00000671 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000625 r9=00000010 r10=00000672 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000626 r9=00000010 r10=00000673 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000627 r9=00000010 r10=00000674 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000628 r9=00000010 r10=00000675 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000629 r9=00000010 r10=00000676 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000062A r9=00000010 r10=00000677 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000062B r9=00000010 r10=00000678 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000062C r9=00000010 r10=00000679 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000062D r9=00000010 r10=0000067A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000062E r9=00000010 r10=0000067B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000062F r9=00000010 r10=0000067C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000630 r9=00000010 r10=0000067D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000631 r9=00000010 r10=0000067E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000632 r9=00000010 r10=0000067F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000633 r9=00000010 r10=00000680 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000634 r9=00000010 r10=00000681 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000635 r9=00000010 r10=00000682 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000636 r9=00000010 r10=00000683 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000637 r9=00000010 r10=00000684 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000638 r9=00000010 r10=00000685 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000639 r9=00000010 r10=00000686 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000063A r9=00000010 r10=00000687 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000063B r9=00000010 r10=00000688 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000063C r9=00000010 r10=00000689 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000063D r9=00000010 r10=0000068A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000063E r9=00000010 r10=0000068B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000063F r9=00000010 r10=0000068C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000640 r9=00000010 r10=0000068D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000641 r9=00000010 r10=0000068E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000642 r9=00000010 r10=0000068F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000643 r9=00000010 r10=00000690 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000644 r9=00000010 r10=00000691 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000645 r9=00000010 r10=00000692 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000646 r9=00000010 r10=00000693 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000647 r9=00000010 r10=00000694 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000648 r9=00000010 r10=00000695 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000649 r9=00000010 r10=00000696 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000064A r9=00000010 r10=00000697 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000064B r9=00000010 r10=00000698 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000064C r9=00000010 r10=00000699 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000064D r9=00000010 r10=0000069A lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000064E r9=00000010 r10=0000069B lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000064F r9=00000010 r10=0000069C lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000650 r9=00000010 r10=0000069D lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000651 r9=00000010 r10=0000069E lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000652 r9=00000010 r10=0000069F lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000653 r9=00000010 r10=000006A0 lr=822F1D5C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000654 r9=00000010 r10=000006A1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000655 r9=00000010 r10=000006A2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000656 r9=00000010 r10=000006A3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000657 r9=00000010 r10=000006A4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000658 r9=00000010 r10=000006A5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000659 r9=00000010 r10=000006A6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000065A r9=00000010 r10=000006A7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000065B r9=00000010 r10=000006A8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000065C r9=00000010 r10=000006A9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000065D r9=00000010 r10=000006AA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000065E r9=00000010 r10=000006AB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000065F r9=00000010 r10=000006AC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000660 r9=00000010 r10=000006AD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000661 r9=00000010 r10=000006AE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000662 r9=00000010 r10=000006AF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000663 r9=00000010 r10=000006B0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000664 r9=00000010 r10=000006B1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000665 r9=00000010 r10=000006B2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000666 r9=00000010 r10=000006B3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000667 r9=00000010 r10=000006B4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000668 r9=00000010 r10=000006B5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000669 r9=00000010 r10=000006B6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000066A r9=00000010 r10=000006B7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000066B r9=00000010 r10=000006B8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000066C r9=00000010 r10=000006B9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000066D r9=00000010 r10=000006BA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000066E r9=00000010 r10=000006BB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000066F r9=00000010 r10=000006BC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000670 r9=00000010 r10=000006BD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000671 r9=00000010 r10=000006BE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000672 r9=00000010 r10=000006BF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000673 r9=00000010 r10=000006C0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000674 r9=00000010 r10=000006C1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000675 r9=00000010 r10=000006C2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000676 r9=00000010 r10=000006C3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000677 r9=00000010 r10=000006C4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000678 r9=00000010 r10=000006C5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000679 r9=00000010 r10=000006C6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000067A r9=00000010 r10=000006C7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000067B r9=00000010 r10=000006C8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000067C r9=00000010 r10=000006C9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000067D r9=00000010 r10=000006CA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000067E r9=00000010 r10=000006CB lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000067F r9=00000010 r10=000006CC lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000680 r9=00000010 r10=000006CD lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000681 r9=00000010 r10=000006CE lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000682 r9=00000010 r10=000006CF lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000683 r9=00000010 r10=000006D0 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000684 r9=00000010 r10=000006D1 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000685 r9=00000010 r10=000006D2 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000686 r9=00000010 r10=000006D3 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000687 r9=00000010 r10=000006D4 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000688 r9=00000010 r10=000006D5 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000689 r9=00000010 r10=000006D6 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000068A r9=00000010 r10=000006D7 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000068B r9=00000010 r10=000006D8 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000068C r9=00000010 r10=000006D9 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000068D r9=00000010 r10=000006DA lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 diff --git a/audit-runs/audit-059-handle-disambiguation/round-A4-ours-chain-probe/ours.log b/audit-runs/audit-059-handle-disambiguation/round-A4-ours-chain-probe/ours.log new file mode 100644 index 0000000..b755616 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round-A4-ours-chain-probe/ours.log @@ -0,0 +1,66 @@ +AUDIT-PC-PROBE pc=0x8216ea68 tid=1 hw=0 cycle=5362918 lr=0x824ab8e0 r3=0x00000000 r11=0x00000000 [r3+0]=0x00000000 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x00000000 [r3+0x30]=0x00000000 +AUDIT-PC-PROBE pc=0x822f1aa8 tid=1 hw=0 cycle=6181256 lr=0x8216ee14 r3=0x40d09a40 r11=0x40111910 [r3+0]=0x00000021 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x40541a40 [r3+0x30]=0x00000000 +AUDIT-PC-PROBE pc=0x822f1b38 tid=1 hw=0 cycle=6181641 lr=0x822f1b38 r3=0x00000001 r11=0x824b0000 [r3+0]=0x00000000 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x00000000 [r3+0x30]=0x00000000 +AUDIT-PC-PROBE pc=0x821746b0 tid=1 hw=0 cycle=9229300 lr=0x82173c38 r3=0x40ba9a80 r11=0x00000000 [r3+0]=0x40111910 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x00000000 [r3+0x30]=0x00000000 +AUDIT-PC-PROBE pc=0x821748f0 tid=13 hw=1 cycle=0 lr=0xbcbcbcbc r3=0x4024a840 r11=0x00000000 [r3+0]=0x40ba9a80 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x00000000 [r3+0x30]=0x4250dec0 + +=== Final State === +PC: 0x00000000 +LR: 0xbcbcbcbc +CTR: 0x00000000 +CR: 0x00000000 +XER: CA=0 OV=0 SO=0 + +=== Thread diagnostics === + hw=0 idx=0 tid=1 state=Blocked(WaitAny { handles: [4208], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x700ff6e0 + r0=0x82153bf0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a72328 + r8=0x43b77284 r9=0x43b77328 r10=0x00000001 r11=0x00000103 r12=0x82173c64 r13=0x7fff0000 + hw=0 idx=1 tid=11 state=Blocked(WaitAny { handles: [2190094916, 2190094880], deadline: None }) pc=0x824d2a94 lr=0x824d2a94 sp=0x71497d90 + r0=0x00000000 r3=0x00000000 r4=0x71497de0 r5=0x00000001 r6=0x00000003 r7=0x00000001 + r8=0x00000000 r9=0x00000000 r10=0x71497df0 r11=0x828a3244 r12=0xbcbcbcbc r13=0x4b9f1000 + hw=1 idx=0 tid=2 state=Blocked(WaitAny { handles: [2189887804], deadline: None }) pc=0x824a95f8 lr=0x824a95f8 sp=0x710ffd20 + r0=0x0000030c r3=0x00000000 r4=0x00000003 r5=0x00000001 r6=0x00000000 r7=0x00000000 + r8=0x00000001 r9=0x6f000000 r10=0x824a9178 r11=0x82870000 r12=0x824a94f0 r13=0x4acc3000 + hw=1 idx=1 tid=13 state=Blocked(WaitAny { handles: [4216], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x715a7a20 + r0=0x821511d0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a723d0 + r8=0x43b77334 r9=0x43b77334 r10=0x40541f80 r11=0x00000001 r12=0x821cb1e0 r13=0x4d1d4000 + hw=2 idx=0 tid=7 state=Blocked(WaitAny { handles: [1111821148], deadline: Some(42946672) }) pc=0x824cd4f4 lr=0x824cd4f4 sp=0x71187e60 + r0=0x00000000 r3=0x00000000 r4=0x00000003 r5=0x00000001 r6=0x00000000 r7=0x71187eb0 + r8=0x00000000 r9=0x00000000 r10=0x00000002 r11=0x00000002 r12=0xbcbcbcbc r13=0x4b1d6000 + hw=2 idx=1 tid=8 state=Blocked(WaitAny { handles: [4176, 4128], deadline: None }) pc=0x824ab214 lr=0x824ab214 sp=0x71287c90 + r0=0x00000000 r3=0x00000000 r4=0x71287cf0 r5=0x00000001 r6=0x00000001 r7=0x00000000 + r8=0x00000000 r9=0x00009030 r10=0x00000002 r11=0x00000020 r12=0x822f1ff0 r13=0x4b90a000 + hw=3 idx=0 tid=4 state=Blocked(WaitAny { handles: [4120], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x7112fb80 + r0=0x821511a0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a723d0 + r8=0x43b7732c r9=0x828f0000 r10=0x00000008 r11=0x00000000 r12=0x8245a660 r13=0x4adc6000 + hw=3 idx=1 tid=5 state=Blocked(WaitAny { handles: [4224], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x7116fbe0 + r0=0x821511a0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a723d0 + r8=0x43b7732c r9=0x828f0000 r10=0x00000001 r11=0x00000000 r12=0x82458b34 r13=0x4adc8000 + hw=4 idx=0 tid=9 state=Ready pc=0x824d140c lr=0x824d22b4 sp=0x71387df0 + r0=0x00000000 r3=0x4250dedc r4=0x4250e040 r5=0x00000001 r6=0x00000000 r7=0x00000000 + r8=0x4b9ec000 r9=0x01010000 r10=0x01010000 r11=0x00000000 r12=0x824d22a8 r13=0x4b9ec000 + hw=5 idx=0 tid=3 state=Blocked(WaitAny { handles: [4112], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x7111fdf0 + r0=0x82153bf0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x00000a10 + r8=0x00000010 r9=0x00000000 r10=0x00009030 r11=0x00000000 r12=0x82181988 r13=0x4adc4000 + hw=5 idx=1 tid=6 state=Ready pc=0x824ab214 lr=0x824ab214 sp=0x7117fc60 + r0=0x821511a0 r3=0x00000001 r4=0x7117fcc0 r5=0x00000001 r6=0x00000001 r7=0x00000000 + r8=0x7117fcb0 r9=0x00009030 r10=0x00000002 r11=0x00000020 r12=0x82458d68 r13=0x4adca000 + hw=5 idx=2 tid=10 state=Ready pc=0x824d1404 lr=0x824d22b4 sp=0x71487e00 + r0=0x00000000 r3=0x4250dedc r4=0x4250e040 r5=0x00000001 r6=0x00000000 r7=0x00000000 + r8=0x4b9ee000 r9=0x01010000 r10=0x01010000 r11=0x00000000 r12=0x824d22a8 r13=0x4b9ee000 + hw=5 idx=3 tid=12 state=Ready pc=0x824aa6a4 lr=0x824aa6a4 sp=0x714a7da0 + r0=0x00000000 r3=0x000000ff r4=0x00000020 r5=0x714a7df4 r6=0x00000000 r7=0x00000000 + r8=0x00000000 r9=0x00000000 r10=0x00000000 r11=0x00000001 r12=0x8217898c r13=0x4d1d2000 + + -- Handle waiter lists -- + handle=0x00001020 Semaphore(0/2147483647) waiters(tid)=[8] + handle=0x42450b5c Event(sig=false, mr=true) waiters(tid)=[7] + handle=0x828a3244 Event(sig=false, mr=false) waiters(tid)=[11] + handle=0x00001018 Semaphore(0/2147483647) waiters(tid)=[4] + handle=0x8287093c Event(sig=false, mr=false) waiters(tid)=[2] + handle=0x00001070 Thread(id=13, exit=None) waiters(tid)=[1] + handle=0x00001080 Event(sig=false, mr=false) waiters(tid)=[5] + handle=0x00001078 Event(sig=false, mr=false) waiters(tid)=[13] + handle=0x828a3220 Event(sig=false, mr=true) waiters(tid)=[11] + handle=0x00001050 Event(sig=false, mr=true) waiters(tid)=[8] + handle=0x00001010 Event(sig=false, mr=true) waiters(tid)=[3] diff --git a/audit-runs/audit-059-handle-disambiguation/round-A4b-ours-spawn-gate/FINDINGS.md b/audit-runs/audit-059-handle-disambiguation/round-A4b-ours-spawn-gate/FINDINGS.md new file mode 100644 index 0000000..79b3a34 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round-A4b-ours-spawn-gate/FINDINGS.md @@ -0,0 +1,167 @@ +# Round-A1..A4 findings — canary tid=6 spawn chain & divergence frontier + +## Anchor reframe (round-37 misread corrected) + +The "factory/registry layer divergence at [0x828E1F08]" framing is falsified. +Both engines install the SAME static-XEX `.rdata` vtable `0x820A183C` at the +singleton's `[+0]`. The instance VAs differ only because of ε-class allocator +divergence (audit-043). + +| Probe | Canary | Ours | +|----------------------------|----------------------|----------------------| +| `[0x828E1F08]` | 0xBC22C910 (heap) | 0x40111910 (heap) | +| `[[0x828E1F08]+0]` vtable | 0x820A183C | 0x820A183C (SAME) | +| `vtable[+0]` thunk | 0x82175330 | 0x82175330 (SAME) | +| `vtable[+8]` thunk | 0x82175340 → b sub_821741C8 | SAME (vtable bytes from XEX `.rdata`) | + +The thunks at 0x82175330+ are 8-byte `lwz r3, 8(r3); b ` +trampolines. Slot 2 (`+0x08`) is the worker dispatch entry that round 33 +identified as 471× in canary tid=6 / 0× in ours. + +## A.1 — Canary dispatcher loop is in sub_822F1AA8 on tid=6 + +Probe `--audit_jit_prolog_pc=0x821741C8 --audit_jit_prolog_r3_bytes=256` on +canary (35 s): + +- ~1678 fires of sub_821741C8 on **tid=6** +- r3 at entry = `0xBCCC4A80` (the inner sub-object of the silph::UImpl + singleton — extracted via the thunk's `lwz r3, 8(r3)`) +- LR at entry = `0x822F1D5C` (return PC after the `bctrl` at 0x822F1D58 inside + sub_822F1AA8) +- Singleton's `[+C0..+D0]` UTF-16 spells "HF Frequency" (a UI label) + +The dispatch site in canary (the `bctrl`) is at PC 0x822F1D58 inside +sub_822F1AA8: +``` +0x822F1D40: lwz r3, 7944(r25) ; r3 = [r25+0x1F08] = [0x828E1F08] +0x822F1D4C: lwz r11, 0(r3) ; vtable +0x822F1D50: lwz r11, 8(r11) ; vtable[+8] = thunk 0x82175340 +0x822F1D54: mtctr r11 +0x822F1D58: bctrl ; → 0x82175340 → b 0x821741C8 +``` + +## A.2 — Canary tid=6 spawn site is sub_821746B0 at PC 0x82174824 + +Enumeration of `ExCreateThread` calls in canary (35 s, 21 unique tuples): + +``` +entry=821748F0 start_ctx=BC365700 lr=824AC5F0 guest_lr=82174828 ← silph dispatcher #1 +entry=821748F0 start_ctx=BC366DA0 lr=824AC5F0 guest_lr=82174828 ← silph dispatcher #2 +``` + +PC `0x82174824` is the `bl 0x82172370` (the `ExCreateThread` thunk) inside +`sub_821746B0`. The setup is: +``` +0x8217480C: lis r11, 0x8217 +0x82174810: li r7, 0 +0x82174814: li r6, 4 ; priority +0x82174818: mr r5, r29 ; start_ctx +0x8217481C: addi r4, r11, 18672 ; r4 = 0x821748F0 (entry) +0x82174820: li r3, 0 +0x82174824: bl 0x82172370 ; ExCreateThread +``` + +The entry `0x821748F0` is a thread main that calls `bl 0x821749C0` (the +inner dispatch). + +## A.3 — sub_822F1AA8 spawns a SECOND thread at 0x822F1B08 + +The dispatch-loop function `sub_822F1AA8` itself ALSO spawns a thread at +PC 0x822F1B08 with entry=`sub_822F1EE0` and `start_ctx=BCE24A40`: +``` +0x822F1AEC: lis r11, 0x822F +0x822F1AFC: addi r4, r11, 7904 ; r4 = 0x822F1EE0 +0x822F1B08: bl 0x82172370 ; ExCreateThread +``` + +sub_822F1EE0 → sub_822F1F20 contains its own atomic state-machine + wait loop. + +## A.3' — sub_822F1AA8 has exactly 2 callers, both in sub_8216EA68 + +``` +source=0x8216ECCC source_func=0x8216EA68 kind=call +source=0x8216EE10 source_func=0x8216EA68 kind=call +``` + +So sub_8216EA68 is the only function that drives sub_822F1AA8. + +## A.4 — Ours' divergence is INSIDE the spawned thread, NOT at the spawn + +Mirror-probed ours at `sub_821746B0` body BB heads (parallel mode, 50M +instructions, XENIA_CACHE_PERSIST=1): + +| PC | Fires | Notes | +|-------------|-------|------------------------------------------------| +| 0x821746B0 | 1 | Entry. r3=0x40ba9a80 | +| 0x821746E0 | 1 | After `bl 0x8284DCFC` (critical-section) | +| 0x82174798 | 1 | After the early `beq` (r28==0 branch) | +| 0x821747B8 | 1 | **Past the gate**: `[0x828E2B14]=0x40105000` non-NULL; `bl 0x82150EF8` returned r3=0x4024a840 (NON-NULL) | +| 0x821747D8 | 1 | After the inner `bl 0x821723F0` | +| 0x8217480C | 1 | Enters the spawn block | +| 0x82174828 | 1 | **Post-`bl ExCreateThread`**, r3=0x1070 = thread handle | + +**OURS DOES SPAWN THE THREAD VIA THIS SITE.** The returned handle 0x1070 is +**tid=13's thread handle** (per round 37 final state). So **ours' tid=13 IS +the same logical thread as canary's tid=6** — spawned by the identical call +site with the same entry (0x821748F0). + +## A.4 — Divergence is INSIDE the spawned thread's body + +Round 37's frame trail for ours' tid=13 wedge: +`0x821CB1E0 → 0x821CBAE0 → 0x821CC454 → 0x821C4F18 → 0x82174A80` + +The LAST frame `0x82174A80` is **inside sub_821749C0** (= the inner dispatch +called from sub_821748F0). It's right after the vtable dispatch at +0x82174A78 (`bctrl` on `[r30+vtable][+16]`): + +``` +0x82174a64: mr r3, r30 ; r3 = some object +0x82174a68: lwz r11, 0(r30) +0x82174a6c: lwz r4, 4(r29) +0x82174a70: lwz r5, 8(r31) +0x82174a74: lwz r11, 16(r11) ; r11 = vtable[+0x10] +0x82174a78: mtctr r11 +0x82174a7c: bctrl ; dispatch +0x82174a80: lwz r3, 0(r29) ; ← wedge frame top (LR after bctrl) +``` + +So `sub_821749C0`'s vtable[+0x10] dispatch on tid=13/tid=6's `r30` object +lands at audit-049 territory in ours (chain through sub_821CB030+0x128 that +ends waiting forever on handle 0x1078). In canary, the same dispatch on the +same object SHOULD land somewhere that ultimately reaches sub_822F1AA8's +dispatch loop and runs sub_821741C8 1678× via vtable[+8]. + +**The object `r30` is the result of `bl 0x821CF3F0`** at PC 0x821749DC. So +sub_821CF3F0 returns a registry-lookup object; the vtable on this object's +slot +0x10 method's body determines whether the thread wedges or runs. + +## Phase B classification + +Class 3 — **Missing init-time precondition**. Ours reaches the spawn site, +ours' tid=13 enters the chain, ours' tid=13 enters sub_821749C0, but the +vtable[+0x10] dispatch at PC 0x82174A78 in ours lands in audit-049 territory +(wait forever on 0x1078) rather than continuing through the canonical chain +toward sub_822F1AA8's outer dispatch loop. + +Possible classes to refine in next round: +- **3a**: same vtable but state-dependent — `r30`'s field at a specific offset + differs in ours vs canary, causing the method body to take a different + branch. +- **3b**: the vtable in `r30` is DIFFERENT in ours vs canary (e.g., ours has + a base-class vtable but canary has a derived-class vtable). +- **4**: synthesis fallback — spawn a SECOND thread that runs sub_822F1AA8's + dispatch loop directly, bypassing the wedged sub_821749C0 chain. + +## Next probe (A.4.5) + +Probe both engines at sub_821749C0 entry filtering tid=13 (ours) / tid=6 +(canary), capturing: +- `r3` and `r4` at entry (the factory-output object and the ctx) +- After the `bl 0x821CF3F0` at 0x821749DC: capture r30 (= sub_821CF3F0 + return — the object whose vtable is dispatched at 0x82174A78) +- At PC 0x82174A78 (the divergent bctrl): r30 + r30+0 (vtable) + vtable[+0x10] + (the dispatch target) + +If ours and canary have IDENTICAL `vtable[+0x10]` targets but the method +body's behavior differs → class 3a (state divergence). If targets differ → +class 3b (vtable identity divergence). diff --git a/audit-runs/audit-059-handle-disambiguation/round-A4b-ours-spawn-gate/ours.log b/audit-runs/audit-059-handle-disambiguation/round-A4b-ours-spawn-gate/ours.log new file mode 100644 index 0000000..8cb6a20 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round-A4b-ours-spawn-gate/ours.log @@ -0,0 +1,91 @@ +AUDIT-PC-PROBE pc=0x821746b0 tid=1 hw=0 cycle=9228833 lr=0x82173c38 r3=0x40ba9a80 r11=0x00000000 [r3+0]=0x40111910 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x00000000 [r3+0x30]=0x00000000 +AUDIT-MEM-READ addr=0x828e2b14 val=0x40105000 vtable=0x40105004 vtable[0]=0x40105008 vtable[24]=0x40105020 pc=0x821746b0 tid=1 cycle=9228833 +AUDIT-PC-PROBE pc=0x821746e0 tid=1 hw=0 cycle=9228856 lr=0x821746e0 r3=0x00000000 r11=0x00000000 [r3+0]=0x00000000 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x00000000 [r3+0x30]=0x00000000 +AUDIT-MEM-READ addr=0x828e2b14 val=0x40105000 vtable=0x40105004 vtable[0]=0x40105008 vtable[24]=0x40105020 pc=0x821746e0 tid=1 cycle=9228856 +AUDIT-PC-PROBE pc=0x82174798 tid=1 hw=0 cycle=9228859 lr=0x821746e0 r3=0x00000000 r11=0x00000000 [r3+0]=0x00000000 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x00000000 [r3+0x30]=0x00000000 +AUDIT-MEM-READ addr=0x828e2b14 val=0x40105000 vtable=0x40105004 vtable[0]=0x40105008 vtable[24]=0x40105020 pc=0x82174798 tid=1 cycle=9228859 +AUDIT-PC-PROBE pc=0x821747b8 tid=1 hw=0 cycle=9229012 lr=0x821747ac r3=0x4024a840 r11=0x4024a840 [r3+0]=0x4024ace0 [[r3+0]+24]=0x43777290 [r3+0x0C]=0x4024a820 [r3+0x30]=0x4250dec0 +AUDIT-MEM-READ addr=0x828e2b14 val=0x40105000 vtable=0x40105004 vtable[0]=0x40105008 vtable[24]=0x40105020 pc=0x821747b8 tid=1 cycle=9229012 +AUDIT-PC-PROBE pc=0x821747d8 tid=1 hw=0 cycle=9229440 lr=0x821747cc r3=0x4024a840 r11=0xffffffff [r3+0]=0x40ba9a80 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x00000000 [r3+0x30]=0x4250dec0 +AUDIT-MEM-READ addr=0x828e2b14 val=0x40105000 vtable=0x40105004 vtable[0]=0x40105008 vtable[24]=0x40105020 pc=0x821747d8 tid=1 cycle=9229440 +AUDIT-PC-PROBE pc=0x8217480c tid=1 hw=0 cycle=9229443 lr=0x821747cc r3=0x4024a840 r11=0xffffffff [r3+0]=0x40ba9a80 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x00000000 [r3+0x30]=0x4250dec0 +AUDIT-MEM-READ addr=0x828e2b14 val=0x40105000 vtable=0x40105004 vtable[0]=0x40105008 vtable[24]=0x40105020 pc=0x8217480c tid=1 cycle=9229443 +AUDIT-PC-PROBE pc=0x82174828 tid=1 hw=0 cycle=9229509 lr=0x82174828 r3=0x00001070 r11=0x824b0000 [r3+0]=0x00000000 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x00000000 [r3+0x30]=0x00000000 +AUDIT-MEM-READ addr=0x828e2b14 val=0x40105000 vtable=0x40105004 vtable[0]=0x40105008 vtable[24]=0x40105020 pc=0x82174828 tid=1 cycle=9229509 + +=== Final State === +PC: 0x824ac578 +LR: 0x824ac578 +CTR: 0x82153bf0 +CR: 0x24000028 +XER: CA=0 OV=0 SO=0 +r0 : 0x0000000082153bf0 +r1 : 0x00000000700ff6e0 +r2 : 0x0000000020000000 +r4 : 0x0000000000000001 +r7 : 0x0000000003a72328 +r8 : 0x0000000043b77284 +r9 : 0x0000000043b77328 +r10: 0x0000000000000001 +r11: 0x0000000000000103 +r12: 0x0000000082173c64 +r13: 0x000000007fff0000 +r18: 0x0000000040d09a7c +r23: 0x00000000828f3844 +r26: 0x000000004024a620 +r27: 0x00000000820a17a8 +r31: 0x0000000000001070 + +=== Thread diagnostics === + hw=0 idx=0 tid=1 state=Blocked(WaitAny { handles: [4208], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x700ff6e0 + r0=0x82153bf0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a72328 + r8=0x43b77284 r9=0x43b77328 r10=0x00000001 r11=0x00000103 r12=0x82173c64 r13=0x7fff0000 + hw=0 idx=1 tid=11 state=Blocked(WaitAny { handles: [2190094916, 2190094880], deadline: None }) pc=0x824d2a94 lr=0x824d2a94 sp=0x71497d90 + r0=0x00000000 r3=0x00000000 r4=0x71497de0 r5=0x00000001 r6=0x00000003 r7=0x00000001 + r8=0x00000000 r9=0x00000000 r10=0x71497df0 r11=0x828a3244 r12=0xbcbcbcbc r13=0x4b9f1000 + hw=1 idx=0 tid=2 state=Blocked(WaitAny { handles: [2189887804], deadline: None }) pc=0x824a95f8 lr=0x824a95f8 sp=0x710ffd20 + r0=0x0000030c r3=0x00000000 r4=0x00000003 r5=0x00000001 r6=0x00000000 r7=0x00000000 + r8=0x00000001 r9=0x6f000000 r10=0x824a9178 r11=0x82870000 r12=0x824a94f0 r13=0x4acc3000 + hw=1 idx=1 tid=13 state=Blocked(WaitAny { handles: [4216], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x715a7a20 + r0=0x821511d0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a723d0 + r8=0x43b77334 r9=0x43b77334 r10=0x40541f80 r11=0x00000001 r12=0x821cb1e0 r13=0x4d1d4000 + hw=2 idx=0 tid=7 state=Blocked(WaitAny { handles: [1111821148], deadline: Some(42946672) }) pc=0x824cd4f4 lr=0x824cd4f4 sp=0x71187e60 + r0=0x00000000 r3=0x00000000 r4=0x00000003 r5=0x00000001 r6=0x00000000 r7=0x71187eb0 + r8=0x00000000 r9=0x00000000 r10=0x00000002 r11=0x00000002 r12=0xbcbcbcbc r13=0x4b1d6000 + hw=2 idx=1 tid=8 state=Blocked(WaitAny { handles: [4176, 4132], deadline: None }) pc=0x824ab214 lr=0x824ab214 sp=0x71287c90 + r0=0x00000000 r3=0x00000000 r4=0x71287cf0 r5=0x00000001 r6=0x00000001 r7=0x00000000 + r8=0x00000000 r9=0x00009030 r10=0x00000002 r11=0x00000020 r12=0x822f1ff0 r13=0x4b90a000 + hw=3 idx=0 tid=4 state=Blocked(WaitAny { handles: [4120], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x7112fb80 + r0=0x821511a0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a723d0 + r8=0x43b7732c r9=0x828f0000 r10=0x00000008 r11=0x00000000 r12=0x8245a660 r13=0x4adc6000 + hw=3 idx=1 tid=5 state=Blocked(WaitAny { handles: [4224], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x7116fbe0 + r0=0x821511a0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a723d0 + r8=0x43b7732c r9=0x828f0000 r10=0x00000001 r11=0x00000000 r12=0x82458b34 r13=0x4adc8000 + hw=4 idx=0 tid=9 state=Ready pc=0x824d140c lr=0x824d22b4 sp=0x71387df0 + r0=0x00000000 r3=0x4250dedc r4=0x4250e040 r5=0x00000001 r6=0x00000000 r7=0x00000000 + r8=0x4b9ec000 r9=0x01010000 r10=0x01010000 r11=0x00000000 r12=0x824d22a8 r13=0x4b9ec000 + hw=5 idx=0 tid=3 state=Blocked(WaitAny { handles: [4112], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x7111fdf0 + r0=0x82153bf0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x00000a10 + r8=0x00000010 r9=0x00000000 r10=0x00009030 r11=0x00000000 r12=0x82181988 r13=0x4adc4000 + hw=5 idx=1 tid=6 state=Ready pc=0x824ab214 lr=0x824ab214 sp=0x7117fc60 + r0=0x821511a0 r3=0x00000001 r4=0x7117fcc0 r5=0x00000001 r6=0x00000001 r7=0x00000000 + r8=0x7117fcb0 r9=0x00009030 r10=0x00000002 r11=0x00000020 r12=0x82458d68 r13=0x4adca000 + hw=5 idx=2 tid=10 state=Ready pc=0x824d140c lr=0x824d22b4 sp=0x71487e00 + r0=0x00000000 r3=0x4250dedc r4=0x4250e040 r5=0x00000001 r6=0x00000000 r7=0x00000000 + r8=0x4b9ee000 r9=0x01010000 r10=0x01010000 r11=0x00000000 r12=0x824d22a8 r13=0x4b9ee000 + hw=5 idx=3 tid=12 state=Ready pc=0x824aa6a4 lr=0x824aa6a4 sp=0x714a7da0 + r0=0x00000000 r3=0x000000ff r4=0x00000020 r5=0x714a7df4 r6=0x00000000 r7=0x00000000 + r8=0x00000000 r9=0x00000000 r10=0x00000000 r11=0x00000001 r12=0x8217898c r13=0x4d1d2000 + + -- Handle waiter lists -- + handle=0x00001024 Semaphore(0/2147483647) waiters(tid)=[8] + handle=0x00001010 Event(sig=false, mr=true) waiters(tid)=[3] + handle=0x00001070 Thread(id=13, exit=None) waiters(tid)=[1] + handle=0x00001080 Event(sig=false, mr=false) waiters(tid)=[5] + handle=0x828a3244 Event(sig=false, mr=false) waiters(tid)=[11] + handle=0x00001018 Semaphore(0/2147483647) waiters(tid)=[4] + handle=0x00001050 Event(sig=false, mr=true) waiters(tid)=[8] + handle=0x00001078 Event(sig=false, mr=false) waiters(tid)=[13] + handle=0x8287093c Event(sig=false, mr=false) waiters(tid)=[2] + handle=0x828a3220 Event(sig=false, mr=true) waiters(tid)=[11] + handle=0x42450b5c Event(sig=false, mr=true) waiters(tid)=[7] diff --git a/audit-runs/audit-059-handle-disambiguation/round-A5-canary-sub821749C0/canary.stdout b/audit-runs/audit-059-handle-disambiguation/round-A5-canary-sub821749C0/canary.stdout new file mode 100644 index 0000000..2aa8961 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round-A5-canary-sub821749C0/canary.stdout @@ -0,0 +1,57950 @@ +i> 000000D4 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D4 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D4 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = true +audit_jit_prolog_mem_dump = 0 +audit_jit_prolog_pc = 2182918192 +audit_jit_prolog_r3_bytes = 64 +audit_track_event_handle = 0 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D4 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D4 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D4 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +i> 00000124 Setup: Initializing Memory... +i> 00000124 Setup: Initializing Exports... +i> 00000124 Setup: Initializing Processor... +i> 00000124 Setup: Initializing Audio... +i> 00000124 Setup: Initializing Graphics... +i> 00000124 Setup: Initializing HID... +i> 00000124 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000124 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000124 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000124 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000124 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000124 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000124 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000124 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000124 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000124 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000124 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000124 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000124 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000124 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000124 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000124 winkey: "L" binds key 0x4C to controller input X. +i> 00000124 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000124 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000124 winkey: "P" binds key 0x50 to controller input Y. +i> 00000124 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000124 winkey: "X" binds key 0x58 to controller input START. +i> 00000124 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000124 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D4 SDL Version 2.32.2 initialized. +w> 000000D4 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000124 Setup: Initializing VFS... +i> 00000124 PatchDB: Loaded patches for 0 titles +i> 00000124 Setup: Initializing Kernel... +i> 00000124 ProfileManager: Found 0 Profiles +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +K> 00000124 AUDIT-HLC XEvent::Set handle=F8000000 kevent_va=00000000 prio=1 lr=00000000 +i> 00000124 Setup: Starting graphics_system... +i> 00000124 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000124 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000124 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000124 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000124 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000154, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=00000158, ) +i> 00000124 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000124 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=0000015C, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000160, ) +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Loading module GAME:\default.xex +F> 000000D4 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D4 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D4 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D4 Title name: PROJECT SYLPHEED +i> 000000D4 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D4 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D4 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D4 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D4 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D4 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D4 KernelState: Launching module... +i> 000000D4 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000190, ) +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000194) +K> F8000008 AUDIT-HLC XThread::Execute tid=6 start_address=824AB748 start_context=00000000 xapi=00000000 +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800000C kevent_va=30029018 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01B8 (F8000010)', native=000001B8) +K> F8000010 AUDIT-HLC XThread::Execute tid=7 start_address=824A93C8 start_context=828A28F0 xapi=00000000 +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000010 AUDIT-HLC XEvent::Set handle=F8000014 kevent_va=00000000 prio=1 lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000020 kevent_va=3002F018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=82181830 start_ctx=828F3D08 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=821817FC +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01BC (F8000024)', native=000001BC) +K> F8000024 AUDIT-HLC XThread::Execute tid=8 start_address=82181830 start_context=828F3D08 xapi=824AFF88 +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +K> F8000008 AUDIT-HLC ExCreateThread entry=8245A5D0 start_ctx=828F4838 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=824592B4 +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C0 (F800002C)', native=000001C0) +K> F800002C AUDIT-HLC XThread::Execute tid=9 start_address=8245A5D0 start_context=828F4838 xapi=824AFF88 +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +K> F800002C AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=00000000 prio=1 lr=8245970C +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800003C kevent_va=3003B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000040 kevent_va=3003D018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=82450A28 start_ctx=828F3B68 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82450034 +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C4 (F8000048)', native=000001C4) +K> F8000048 AUDIT-HLC XThread::Execute tid=10 start_address=82450A28 start_context=828F3B68 xapi=824AFF88 +K> F8000008 AUDIT-HLC NtDuplicateObject src=F800003C dst=F800004C options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000050 kevent_va=30045018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000050 kevent_va=30045018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000050 kevent_va=30045018 prio=0 lr=824AAFC8 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800003C kevent_va=3003B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000038 kevent_va=3003B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000038 dst=F800003C options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F800004C kevent_va=30045018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F800004C kevent_va=30045018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800004C kevent_va=30045018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F800004C kevent_va=30045018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000050 kevent_va=30047018 lr=824A9F6C +K> F8000048 AUDIT-HLC ExCreateThread entry=82457EF0 start_ctx=828F3B08 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82457EA0 +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01C8 (F8000058)', native=000001C8) +K> F8000058 AUDIT-HLC XThread::Execute tid=11 start_address=82457EF0 start_context=828F3B08 xapi=824AFF88 +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F800004C kevent_va=30045018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=3003B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000038 kevent_va=30045018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=824CD458 start_ctx=BE56BB3C xapi=00000000 flags=04000080 lr=824CD984 guest_lr=824C1AD8 +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01CC (F800004C)', native=000001CC) +K> F800004C AUDIT-HLC XThread::Execute tid=12 start_address=824CD458 start_context=BE56BB3C xapi=00000000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC singleton[0x828E1F08]=BC22C910 vtable=820A183C vtable[0]=82175330 vtable[24]=82175378 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000060 kevent_va=30053018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000064 kevent_va=30055018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=822F1EE0 start_ctx=BCE24A40 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822F1B0C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D0 (F8000068)', native=000001D0) +K> F8000068 AUDIT-HLC XThread::Execute tid=13 start_address=822F1EE0 start_context=BCE24A40 xapi=824AFF88 +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000070 kevent_va=3005B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000070 dst=F8000074 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000078 kevent_va=3005D018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000070 kevent_va=3005B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000070 kevent_va=3005B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000070 dst=F8000074 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000078 kevent_va=3005D018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000070 kevent_va=3005B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC ExCreateThread entry=824D2878 start_ctx=00000000 xapi=00000000 flags=10000001 lr=824D2E68 guest_lr=824D059C +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +K> F8000008 AUDIT-HLC ExCreateThread entry=824D2940 start_ctx=00000000 xapi=00000000 flags=20000001 lr=824D2E68 guest_lr=824D059C +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D4 (F8000070)', native=000001D4) +K> F8000070 AUDIT-HLC XThread::Execute tid=14 start_address=824D2878 start_context=00000000 xapi=00000000 +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01D8 (F8000074)', native=000001D8) +K> F8000074 AUDIT-HLC XThread::Execute tid=15 start_address=824D2940 start_context=00000000 xapi=00000000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x7a917026af90 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000084 kevent_va=30064018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30066018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtDuplicateObject src=F8000084 dst=F800008C options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000084 kevent_va=30064018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000084 kevent_va=30064018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000084 dst=F800008C options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=82460078 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000084 kevent_va=30064018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=82460150 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000084 kevent_va=30064018 lr=824A9F6C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000084 dst=F800008C options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000084 kevent_va=30064018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E8D50 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC ExCreateThread entry=82178950 start_ctx=828F3EC0 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82178F08 +i> F8000008 XThreadF8000084 (10) Stack: 705A0000-705B0000 +K> F8000084 XThread::Execute thid 16 (handle=F8000084, 'XThread01EC (F8000084)', native=000001EC) +K> F8000084 AUDIT-HLC XThread::Execute tid=16 start_address=82178950 start_context=828F3EC0 xapi=824AFF88 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000090 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000090 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=82173BF0 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=821748F0 start_ctx=BC365700 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=82174828 +i> F8000008 XThreadF8000094 (11) Stack: 705D0000-70650000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000094 XThread::Execute thid 17 (handle=F8000094, 'XThread01F0 (F8000094)', native=000001F0) +K> F8000094 AUDIT-HLC XThread::Execute tid=17 start_address=821748F0 start_context=BC365700 xapi=824AFF88 +K> F8000094 AUDIT-HLC JitProlog pc=821749C0 tid=00000011 r3=BCCC4A80 r4=BC365700 r5=7064FDD4 r6=00000000 r7=00000000 r8=00000000 r9=00000001 r10=0000001C lr=82174920 +K> F8000094 AUDIT-HLC JitProlog pc=821749C0 r3+00: BC22C910 00000000 00000000 00000000 +K> F8000094 AUDIT-HLC JitProlog pc=821749C0 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000094 AUDIT-HLC JitProlog pc=821749C0 r3+20: FFFFFFFF 00000000 00000000 00000000 +K> F8000094 AUDIT-HLC JitProlog pc=821749C0 r3+30: 00000000 00000000 00000000 00000000 +K> F8000094 AUDIT-HLC NtCreateEvent handle=F8000098 type=1 initial_state=1 lr=824A9F6C +K> F8000094 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=3006E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000094 AUDIT-HLC NtCreateEvent handle=F800009C type=0 initial_state=0 lr=824A9F6C +K> F8000094 AUDIT-HLC NtCreateEvent_inner handle=F800009C kevent_va=30070018 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000094 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000094 AUDIT-HLC NtDuplicateObject src=F800009C dst=F80000A4 options=00000002 lr=824AA3B4 +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30072018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30072018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30072018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30072018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30072018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800009C kevent_va=30070018 prio=0 lr=824AA304 +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> F8000094 AUDIT-HLC ExCreateThread entry=821C4AD0 start_ctx=BCA44C00 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=821C4F64 +i> F8000094 XThreadF800009C (12) Stack: 70670000-70680000 +K> F800009C XThread::Execute thid 18 (handle=F800009C, 'XThread01F4 (F800009C)', native=000001F4) +K> F800009C AUDIT-HLC XThread::Execute tid=18 start_address=821C4AD0 start_context=BCA44C00 xapi=824AFF88 +K> F800009C AUDIT-HLC ExCreateThread entry=822C6870 start_ctx=828F3300 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822C66F4 +i> F800009C XThreadF80000A4 (13) Stack: 706A0000-706D0000 +K> F800009C AUDIT-HLC ExCreateThread entry=822C6870 start_ctx=828F3300 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822C66F4 +i> F800009C XThreadF80000A8 (14) Stack: 706F0000-70720000 +K> F80000A4 XThread::Execute thid 19 (handle=F80000A4, 'XThread01F8 (F80000A4)', native=000001F8) +K> F80000A4 AUDIT-HLC XThread::Execute tid=19 start_address=822C6870 start_context=828F3300 xapi=824AFF88 +K> F80000A8 XThread::Execute thid 20 (handle=F80000A8, 'XThread01FC (F80000A8)', native=000001FC) +K> F80000A8 AUDIT-HLC XThread::Execute tid=20 start_address=822C6870 start_context=828F3300 xapi=824AFF88 +K> F80000A4 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000094 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +F> F8000094 HostPathDevice::ResolvePath(\87719002\c\dba806e) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +F> F8000094 HostPathDevice::ResolvePath(\87719002\c) +K> F8000094 AUDIT-HLC NtDuplicateObject src=F80000AC dst=F80000B4 options=00000002 lr=824AA3B4 +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000094 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30080018 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000094 HostPathDevice::ResolvePath(\87719002\c) +K> F8000094 AUDIT-HLC NtDuplicateObject src=F80000B8 dst=F80000C0 options=00000002 lr=824AA3B4 +F> F800009C DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +K> F8000094 AUDIT-HLC NtCreateEvent_inner handle=F80000C8 kevent_va=30082018 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtCreateEvent_inner handle=F80000CC kevent_va=30084018 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\a) +K> F8000094 AUDIT-HLC NtDuplicateObject src=F80000C8 dst=F80000D4 options=00000002 lr=824AA3B4 +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000094 AUDIT-HLC NtCreateEvent_inner handle=F80000D8 kevent_va=30086018 lr=824A9F6C +K> F800009C AUDIT-HLC NtDuplicateObject src=F80000CC dst=F80000DC options=00000002 lr=824AA3B4 +F> F8000094 HostPathDevice::ResolvePath(\87719002\2\85d8849) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFCC8 +F> F8000094 HostPathDevice::ResolvePath(\87719002\2) +K> F8000094 AUDIT-HLC NtDuplicateObject src=F80000D8 dst=F80000E4 options=00000002 lr=824AA3B4 +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000094 AUDIT-HLC NtCreateEvent_inner handle=F80000E8 kevent_va=30088018 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000094 HostPathDevice::ResolvePath(\87719002\a) +K> F8000094 AUDIT-HLC NtDuplicateObject src=F80000E8 dst=F80000F0 options=00000002 lr=824AA3B4 +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000094 AUDIT-HLC NtCreateEvent_inner handle=F80000F4 kevent_va=3008A018 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000094 HostPathDevice::ResolvePath(\87719002\c) +K> F8000094 AUDIT-HLC NtDuplicateObject src=F80000F4 dst=F80000FC options=00000002 lr=824AA3B4 +K> F8000094 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000094 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=3008C018 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000094 HostPathDevice::ResolvePath(\87719002\0) +K> F8000094 AUDIT-HLC NtDuplicateObject src=F8000100 dst=F8000108 options=00000002 lr=824AA3B4 +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=821C515C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F800010C kevent_va=3008E018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F800010C kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800010C kevent_va=3008E018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C0 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30080018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=30082018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=30084018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F800009C AUDIT-HLC NtDuplicateObject src=F80000CC dst=F80000B0 options=00000002 lr=824AA3B4 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D8 kevent_va=30086018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F0 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30088018 prio=0 lr=824AA304 +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000FC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000F4 kevent_va=3008A018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=30088018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000108 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=3008C018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=824563E0 start_ctx=828F3E70 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82456A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +i> F8000008 XThreadF80000BC (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000090 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F80000BC XThread::Execute thid 21 (handle=F80000BC, 'XThread0200 (F80000BC)', native=00000200) +K> F80000BC AUDIT-HLC XThread::Execute tid=21 start_address=824563E0 start_context=828F3E70 xapi=824AFF88 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=30084018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F800009C AUDIT-HLC NtDuplicateObject src=F80000CC dst=F80000B0 options=00000002 lr=824AA3B4 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000090 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30090018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=82170430 start_ctx=828F4070 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82170260 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +i> F8000008 XThreadF80000D4 (16) Stack: 70600000-70610000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F80000D4 XThread::Execute thid 22 (handle=F80000D4, 'XThread0204 (F80000D4)', native=00000204) +K> F80000D4 AUDIT-HLC XThread::Execute tid=22 start_address=82170430 start_context=828F4070 xapi=824AFF88 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30096018 lr=824A9F6C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000C0 lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F80000D4 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=30084018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +F> F800009C DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtCreateEvent_inner handle=F80000CC kevent_va=30096018 lr=824A9F6C +K> F800009C AUDIT-HLC NtDuplicateObject src=F80000CC dst=F80000DC options=00000002 lr=824AA3B4 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30098018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30098018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30098018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=30096018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F800009C AUDIT-HLC NtDuplicateObject src=F80000CC dst=F80000DC options=00000002 lr=824AA3B4 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30098018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000E4 kevent_va=3009A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30098018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30098018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDE30 start_ctx=828F3C4C xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=823DDDB4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +i> F8000008 XThreadF80000EC (17) Stack: 70630000-70640000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=300A0018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=300A0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=300A0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=300A0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=300A0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=300A0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=300A0018 lr=824A9F6C +K> F80000EC XThread::Execute thid 23 (handle=F80000EC, 'XThread0208 (F80000EC)', native=00000208) +K> F80000EC AUDIT-HLC XThread::Execute tid=23 start_address=823DDE30 start_context=828F3C4C xapi=824AFF88 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=300A0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=300A0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=300A0018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000F0 kevent_va=300A2018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDB50 start_ctx=828F3C88 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=823DD924 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=300A0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=300A0018 prio=0 lr=824AAFC8 +i> F8000008 XThreadF80000FC (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=300A0018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=300A0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=300A0018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDB50 start_ctx=828F3C88 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=823DD924 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +i> F8000008 XThreadF8000108 (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F80000FC XThread::Execute thid 24 (handle=F80000FC, 'XThread020C (F80000FC)', native=0000020C) +K> F80000FC AUDIT-HLC XThread::Execute tid=24 start_address=823DDB50 start_context=828F3C88 xapi=824AFF88 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000108 XThread::Execute thid 25 (handle=F8000108, 'XThread0210 (F8000108)', native=00000210) +K> F8000108 AUDIT-HLC XThread::Execute tid=25 start_address=823DDB50 start_context=828F3C88 xapi=824AFF88 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=82172DF4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=30096018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F800009C AUDIT-HLC NtDuplicateObject src=F80000CC dst=F80000DC options=00000002 lr=824AA3B4 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300AA018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300AA018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=30096018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F800009C DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000C4 type=1 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtCreateEvent_inner handle=F80000C4 kevent_va=3007E018 lr=824A9F6C +K> F800009C AUDIT-HLC NtDuplicateObject src=F80000C4 dst=F80000CC options=00000002 lr=824AA3B4 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C4 kevent_va=3007E018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F800009C AUDIT-HLC NtDuplicateObject src=F80000C4 dst=F80000CC options=00000002 lr=824AA3B4 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C4 kevent_va=3007E018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F800009C AUDIT-HLC NtDuplicateObject src=F80000C4 dst=F80000CC options=00000002 lr=824AA3B4 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30096018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30096018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C4 kevent_va=3007E018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\d) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000CC kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000CC kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=00000000 prio=1 lr=82454D74 +K> F8000008 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=00000000 prio=1 lr=82454C0C +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=00000000 prio=1 lr=824549A0 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=00000000 prio=1 lr=824549E8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000AC dst=F8000104 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000104 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\5) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000AC dst=F8000104 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000104 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\a) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000AC dst=F8000104 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000104 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=30096018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000AC dst=F8000104 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000104 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800009C AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=30096018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000AC dst=F8000104 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000104 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=821CC1B8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=00000000 prio=1 lr=823DF714 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827EED8C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E843C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827ED704 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827ECBB8 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E843C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E9C9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000098 lr=824AA304 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=3006E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B8 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B8 result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=821CC1B8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000098 lr=824AA304 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=3006E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=821748F0 start_ctx=BC365E00 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=82174828 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +i> F8000008 XThreadF80000C4 (1A) Stack: 70880000-70900000 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000C4 XThread::Execute thid 26 (handle=F80000C4, 'XThread0214 (F80000C4)', native=00000214) +K> F80000C4 AUDIT-HLC XThread::Execute tid=26 start_address=821748F0 start_context=BC365E00 xapi=824AFF88 +K> F80000C4 AUDIT-HLC JitProlog pc=821749C0 tid=0000001A r3=BCCC4A80 r4=BC365E00 r5=708FFDD4 r6=00000000 r7=00000000 r8=00000000 r9=00000001 r10=0000001C lr=82174920 +K> F80000C4 AUDIT-HLC JitProlog pc=821749C0 r3+00: BC22C910 00000000 00000000 000003E8 +K> F80000C4 AUDIT-HLC JitProlog pc=821749C0 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F80000C4 AUDIT-HLC JitProlog pc=821749C0 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 +K> F80000C4 AUDIT-HLC JitProlog pc=821749C0 r3+30: 00000000 00000000 00000000 BC3661A0 +K> F80000C4 AUDIT-HLC NtCreateEvent handle=F8000104 type=1 initial_state=1 lr=824A9F6C +K> F80000C4 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300AA018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F80000C4 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F80000C4 AUDIT-HLC NtCreateEvent_inner handle=F800010C kevent_va=300B0018 lr=824A9F6C +F> F80000C4 HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +F> F80000C4 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F80000C4 AUDIT-HLC NtDuplicateObject src=F800010C dst=F8000114 options=00000002 lr=824AA3B4 +K> F80000C4 AUDIT-HLC NtWaitForSingleObjectEx handle=F800010C alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000118 kevent_va=300B2018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B2018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000118 kevent_va=300B2018 lr=824A9F6C +K> F8000048 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=00000000 prio=1 lr=8245802C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000118 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000118 lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B2018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000118 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800010C kevent_va=300B0018 prio=0 lr=824AA304 +K> F80000C4 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800010C result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F80000C4 AUDIT-HLC XEvent::Set handle=F800010C kevent_va=00000000 prio=1 lr=8217B148 +K> F8000084 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000084 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +F> F8000084 DiscImageDevice::ResolvePath(\dat) +K> F8000084 AUDIT-HLC NtDuplicateObject src=F8000110 dst=F8000118 options=00000002 lr=824AA3B4 +K> F8000084 AUDIT-HLC NtSetEvent handle=F8000118 lr=824AA304 guest_lr=82460078 +K> F8000084 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000110 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000110 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800010C kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800010C kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800010C kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800010C kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800010C kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800010C kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B0018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC XEvent::Set handle=F800010C kevent_va=00000000 prio=1 lr=82178D9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F80000C4 AUDIT-HLC XEvent::Set handle=F800010C kevent_va=00000000 prio=1 lr=8217C6F4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B8 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B8 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=30080018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000118 kevent_va=30096018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000120 kevent_va=300B0018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000124 kevent_va=300B2018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000128 kevent_va=300B4018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800012C kevent_va=300B6018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000130 kevent_va=300B8018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000134 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000134 kevent_va=300BA018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800013C kevent_va=300BC018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000140 kevent_va=300BE018 lr=824A9F6C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000144 kevent_va=300C0018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000148 kevent_va=300C2018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800014C kevent_va=300C4018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000150 kevent_va=300C6018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000154 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000154 kevent_va=300C8018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000158 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000158 kevent_va=300CA018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC ExCreateThread entry=82506528 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF800015C (1B) Stack: 70880000-70890000 +K> F8000008 AUDIT-HLC ExCreateThread entry=82506558 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF8000160 (1C) Stack: 708B0000-708C0000 +K> F8000008 AUDIT-HLC ExCreateThread entry=82506588 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF8000164 (1D) Stack: 708E0000-708F0000 +K> F8000008 AUDIT-HLC ExCreateThread entry=825065B8 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +i> F8000008 XThreadF8000168 (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800016C kevent_va=00000000 prio=1 lr=824D091C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=82172DF4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25284 lr=82507ABC +K> F8000068 AUDIT-HLC silph_ctx_dump ctx_base=BCE251C0 (event BCE25284 at +C4) +K> F8000068 AUDIT-HLC DUMP BCE251C0: 8200A1E8 BCE251C0 BCE251C0 00000001 +K> F8000068 AUDIT-HLC DUMP BCE251D0: 01000000 00000000 3F7FCCCC 3F802D83 +K> F8000068 AUDIT-HLC DUMP BCE251E0: 00000000 00000001 30057018 BCE25640 +K> F8000068 AUDIT-HLC DUMP BCE251F0: BE568F00 00000000 00000000 00000000 +K> F8000068 AUDIT-HLC DUMP BCE25200: 00000000 00000000 00000000 00000000 +K> F8000068 AUDIT-HLC DUMP BCE25210: 00000000 01000000 00000000 BCE2521C +K> F8000068 AUDIT-HLC DUMP BCE25220: BCE2521C 01000000 00000000 BCE2522C +K> F8000068 AUDIT-HLC DUMP BCE25230: BCE2522C 01000000 00000000 BCE2523C +K> F8000068 AUDIT-HLC DUMP BCE25240: BCE2523C 01000000 00000000 BCE2524C +K> F8000068 AUDIT-HLC DUMP BCE25250: BCE2524C 00000000 00000001 58454E00 +K> F8000068 AUDIT-HLC DUMP BCE25260: F8000170 00000000 00000001 58454E00 +K> F8000068 AUDIT-HLC DUMP BCE25270: F8000174 00000000 00000001 58454E00 +K> F8000068 AUDIT-HLC DUMP BCE25280: F8000178 00000000 00000001 58454E00 +K> F8000068 AUDIT-HLC DUMP BCE25290: F800017C 00000001 00000001 00000005 +K> F8000068 AUDIT-HLC DUMP BCE252A0: 00000000 00000000 00000500 000002D0 +K> F8000068 AUDIT-HLC DUMP BCE252B0: 00000001 00000000 00000000 00000000 +K> F8000068 AUDIT-HLC DUMP BCE252C0: 00000000 00000000 F800015C F8000160 +K> F8000068 AUDIT-HLC DUMP BCE252D0: F8000164 F8000168 3F800000 00000000 +K> F8000068 AUDIT-HLC DUMP BCE252E0: 00000000 00000000 C9D4E2F1 00458000 +K> F8000068 AUDIT-HLC DUMP BCE252F0: 00053C96 E1B10217 00273000 0000D852 +K> F8000068 AUDIT-HLC DUMP BCE25300: EF97D70C 00533800 0000C068 FC2B1076 +K> F8000068 AUDIT-HLC DUMP BCE25310: 00228800 00000096 00000000 00000000 +K> F8000068 AUDIT-HLC DUMP BCE25320: 00000000 00000000 00000000 00000000 +K> F8000068 AUDIT-HLC DUMP BCE25330: 00000000 00000000 00000000 00000000 +K> F8000068 AUDIT-HLC DUMP BCE25340: 07C65ADA 001EE000 0003A313 0A16C32D +K> F8000068 AUDIT-HLC DUMP BCE25350: 004E6800 00000096 15B20D91 004AC000 +K> F8000068 AUDIT-HLC DUMP BCE25360: 0003A313 28824F7D 002A0000 0001A7B3 +K> F8000068 AUDIT-HLC DUMP BCE25370: 340AB384 00281000 0001EED7 366E0234 +K> F8000068 AUDIT-HLC DUMP BCE25380: 00562800 0001B751 389766D3 00255800 +K> F8000068 AUDIT-HLC DUMP BCE25390: 0000D21B 399D8FD3 00263000 0000FAA7 +K> F8000068 AUDIT-HLC DUMP BCE253A0: 42589090 00540000 000220D3 46844E1D +K> F8000068 AUDIT-HLC DUMP BCE253B0: 00516000 0000D8F5 478A771D 00524000 +K> F8000068 AUDIT-HLC DUMP BCE253C0: 0000F3F8 4EF1DADB 0017E000 000064BD +K> F8000068 AUDIT-HLC DUMP BCE253D0: 53D66292 00000000 0017D9C4 5C3FBE10 +K> F8000068 AUDIT-HLC DUMP BCE253E0: 00438800 0000778E 6110543D 002BA800 +K> F8000068 AUDIT-HLC DUMP BCE253F0: 0017D9C4 8E32D0DC 00251800 00003E12 +K> F8000068 AUDIT-HLC DUMP BCE25400: 99D964C8 00184800 00017C57 9CE5067F +K> F8000068 AUDIT-HLC DUMP BCE25410: 00511000 00004AE7 A7B85146 00440000 +K> F8000068 AUDIT-HLC DUMP BCE25420: 0001790C B408C4D3 00229000 000282BA +K> F8000068 AUDIT-HLC DUMP BCE25430: BBF5F673 0019C800 0005116C C2E7AB28 +K> F8000068 AUDIT-HLC DUMP BCE25440: 004E7000 00029B67 C9D4E2F1 00458000 +K> F8000068 AUDIT-HLC DUMP BCE25450: 00053C96 E1B10217 00273000 0000D852 +K> F8000068 AUDIT-HLC DUMP BCE25460: EF97D70C 00533800 0000C068 FC2B1076 +K> F8000068 AUDIT-HLC DUMP BCE25470: 00228800 00000096 00000000 00000000 +K> F8000068 AUDIT-HLC DUMP BCE25480: 00000000 00000000 00000000 00000000 +K> F8000068 AUDIT-HLC DUMP BCE25490: 00000000 00000000 00000000 00000000 +K> F8000068 AUDIT-HLC DUMP BCE254A0: 00000000 00000000 00000000 00000000 +K> F8000068 AUDIT-HLC DUMP BCE254B0: 00000000 00000000 00000000 00000000 +K> F8000068 AUDIT-HLC silph_ctx event-slots: +K> F8000068 AUDIT-HLC slot[0] off=+54 addr=BCE25214 hdr=01000000 state=00000000 +K> F8000068 AUDIT-HLC slot[1] off=+64 addr=BCE25224 hdr=01000000 state=00000000 +K> F8000068 AUDIT-HLC slot[2] off=+74 addr=BCE25234 hdr=01000000 state=00000000 +K> F8000068 AUDIT-HLC slot[3] off=+84 addr=BCE25244 hdr=01000000 state=00000000 +K> F8000068 AUDIT-HLC slot[4] off=+94 addr=BCE25254 hdr=00000000 state=00000001 +K> F8000068 AUDIT-HLC slot[5] off=+A4 addr=BCE25264 hdr=00000000 state=00000001 +K> F8000068 AUDIT-HLC slot[6] off=+B4 addr=BCE25274 hdr=00000000 state=00000001 +K> F8000068 AUDIT-HLC slot[7] off=+C4 addr=BCE25284 hdr=00000000 state=00000001 +K> F8000068 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82507ABC +K> F800015C XThread::Execute thid 27 (handle=F800015C, 'XThread0218 (F800015C)', native=00000218) +K> F800015C AUDIT-HLC XThread::Execute tid=27 start_address=82506528 start_context=BCE251C0 xapi=824AFF88 +K> F8000160 XThread::Execute thid 28 (handle=F8000160, 'XThread021C (F8000160)', native=0000021C) +K> F8000160 AUDIT-HLC XThread::Execute tid=28 start_address=82506558 start_context=BCE251C0 xapi=824AFF88 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000164 XThread::Execute thid 29 (handle=F8000164, 'XThread0220 (F8000164)', native=00000220) +K> F8000164 AUDIT-HLC XThread::Execute tid=29 start_address=82506588 start_context=BCE251C0 xapi=824AFF88 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800016C kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E9C9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827ED1E4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E843C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827ED1E4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=00000000 prio=1 lr=827E9C9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=30080018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30096018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30096018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800018C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C diff --git a/audit-runs/audit-059-handle-disambiguation/round-A6-canary-822F1AA8/canary.stdout b/audit-runs/audit-059-handle-disambiguation/round-A6-canary-822F1AA8/canary.stdout new file mode 100644 index 0000000..dd0522c --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round-A6-canary-822F1AA8/canary.stdout @@ -0,0 +1,59551 @@ +i> 000000D4 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D4 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D4 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = true +audit_jit_prolog_mem_dump = 0 +audit_jit_prolog_pc = 2182918192 +audit_jit_prolog_r3_bytes = 64 +audit_track_event_handle = 0 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D4 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D4 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D4 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +i> 00000124 Setup: Initializing Memory... +i> 00000124 Setup: Initializing Exports... +i> 00000124 Setup: Initializing Processor... +i> 00000124 Setup: Initializing Audio... +i> 00000124 Setup: Initializing Graphics... +i> 00000124 Setup: Initializing HID... +i> 00000124 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000124 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000124 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000124 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000124 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000124 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000124 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000124 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000124 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000124 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000124 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000124 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000124 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000124 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000124 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000124 winkey: "L" binds key 0x4C to controller input X. +i> 00000124 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000124 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000124 winkey: "P" binds key 0x50 to controller input Y. +i> 00000124 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000124 winkey: "X" binds key 0x58 to controller input START. +i> 00000124 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000124 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D4 SDL Version 2.32.2 initialized. +w> 000000D4 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000124 Setup: Initializing VFS... +i> 00000124 PatchDB: Loaded patches for 0 titles +i> 00000124 Setup: Initializing Kernel... +i> 00000124 ProfileManager: Found 0 Profiles +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +K> 00000124 AUDIT-HLC XEvent::Set handle=F8000000 kevent_va=00000000 prio=1 lr=00000000 +i> 00000124 Setup: Starting graphics_system... +i> 00000124 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000124 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000124 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000124 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000124 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000154, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=00000158, ) +i> 00000124 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000124 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000180, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000184, ) +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Loading module GAME:\default.xex +F> 000000D4 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D4 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D4 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D4 Title name: PROJECT SYLPHEED +i> 000000D4 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D4 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D4 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D4 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D4 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D4 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D4 KernelState: Launching module... +i> 000000D4 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000190, ) +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000194) +K> F8000008 AUDIT-HLC XThread::Execute tid=6 start_address=824AB748 start_context=00000000 xapi=00000000 +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800000C kevent_va=30029018 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01B8 (F8000010)', native=000001B8) +K> F8000010 AUDIT-HLC XThread::Execute tid=7 start_address=824A93C8 start_context=828A28F0 xapi=00000000 +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000010 AUDIT-HLC XEvent::Set handle=F8000014 kevent_va=00000000 prio=1 lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000020 kevent_va=3002F018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=82181830 start_ctx=828F3D08 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=821817FC +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01BC (F8000024)', native=000001BC) +K> F8000024 AUDIT-HLC XThread::Execute tid=8 start_address=82181830 start_context=828F3D08 xapi=824AFF88 +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +K> F8000008 AUDIT-HLC ExCreateThread entry=8245A5D0 start_ctx=828F4838 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=824592B4 +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C0 (F800002C)', native=000001C0) +K> F800002C AUDIT-HLC XThread::Execute tid=9 start_address=8245A5D0 start_context=828F4838 xapi=824AFF88 +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=00000000 prio=1 lr=8245ADEC +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800003C kevent_va=3003B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000040 kevent_va=3003D018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=82450A28 start_ctx=828F3B68 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82450034 +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C4 (F8000048)', native=000001C4) +K> F8000048 AUDIT-HLC XThread::Execute tid=10 start_address=82450A28 start_context=828F3B68 xapi=824AFF88 +K> F8000008 AUDIT-HLC NtDuplicateObject src=F800003C dst=F800004C options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000050 kevent_va=30045018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000050 kevent_va=30045018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000050 kevent_va=30045018 prio=0 lr=824AAFC8 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800003C kevent_va=3003B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000038 kevent_va=3003B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000038 dst=F800003C options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F800004C kevent_va=30045018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F800004C kevent_va=30045018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800004C kevent_va=30045018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F800004C kevent_va=30045018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000050 kevent_va=30047018 lr=824A9F6C +K> F8000048 AUDIT-HLC ExCreateThread entry=82457EF0 start_ctx=828F3B08 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82457EA0 +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01C8 (F8000058)', native=000001C8) +K> F8000058 AUDIT-HLC XThread::Execute tid=11 start_address=82457EF0 start_context=828F3B08 xapi=824AFF88 +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F800004C kevent_va=30045018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=3003B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000038 kevent_va=30045018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=824CD458 start_ctx=BE56BB3C xapi=00000000 flags=04000080 lr=824CD984 guest_lr=824C1AD8 +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC singleton[0x828E1F08]=BC22C910 vtable=820A183C vtable[0]=82175330 vtable[24]=82175378 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01CC (F800004C)', native=000001CC) +K> F800004C AUDIT-HLC XThread::Execute tid=12 start_address=824CD458 start_context=BE56BB3C xapi=00000000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC JitProlog pc=822F1AA8 tid=00000006 r3=BCE24A40 r4=00000000 r5=00000000 r6=02D00000 r7=00000000 r8=02D00500 r9=00000000 r10=00000000 lr=8216EE14 +K> F8000008 AUDIT-HLC JitProlog pc=822F1AA8 r3+00: 00000021 00000001 BE568F00 BC65CA00 +K> F8000008 AUDIT-HLC JitProlog pc=822F1AA8 r3+10: BC65C980 BC65C9C0 BC65CA40 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=822F1AA8 r3+20: 00000000 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=822F1AA8 r3+30: 00000000 00000000 00000006 00000000 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000060 kevent_va=30053018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000064 kevent_va=30055018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=822F1EE0 start_ctx=BCE24A40 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822F1B0C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D0 (F8000068)', native=000001D0) +K> F8000068 AUDIT-HLC XThread::Execute tid=13 start_address=822F1EE0 start_context=BCE24A40 xapi=824AFF88 +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000070 kevent_va=3005B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000070 dst=F8000074 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000078 kevent_va=3005D018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> F8000048 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=8245802C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000070 kevent_va=3005B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000070 kevent_va=3005B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000070 dst=F8000074 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000078 kevent_va=3005D018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> F8000048 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=8245802C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000070 kevent_va=3005B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC ExCreateThread entry=824D2878 start_ctx=00000000 xapi=00000000 flags=10000001 lr=824D2E68 guest_lr=824D059C +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +K> F8000008 AUDIT-HLC ExCreateThread entry=824D2940 start_ctx=00000000 xapi=00000000 flags=20000001 lr=824D2E68 guest_lr=824D059C +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D4 (F8000070)', native=000001D4) +K> F8000070 AUDIT-HLC XThread::Execute tid=14 start_address=824D2878 start_context=00000000 xapi=00000000 +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01D8 (F8000074)', native=000001D8) +K> F8000074 AUDIT-HLC XThread::Execute tid=15 start_address=824D2940 start_context=00000000 xapi=00000000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x746db2010040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000088 kevent_va=30064018 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtDuplicateObject src=F8000088 dst=F8000090 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=30064018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000088 kevent_va=30064018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000088 dst=F8000090 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 guest_lr=82460078 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=30064018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000088 kevent_va=30064018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000088 dst=F8000090 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=30064018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E8E68 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC ExCreateThread entry=82178950 start_ctx=828F3EC0 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82178F08 +i> F8000008 XThreadF8000088 (10) Stack: 705A0000-705B0000 +K> F8000088 XThread::Execute thid 16 (handle=F8000088, 'XThread01EC (F8000088)', native=000001EC) +K> F8000088 AUDIT-HLC XThread::Execute tid=16 start_address=82178950 start_context=828F3EC0 xapi=824AFF88 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=82173BF0 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=821748F0 start_ctx=BC365700 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=82174828 +i> F8000008 XThreadF8000098 (11) Stack: 705D0000-70650000 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000098 XThread::Execute thid 17 (handle=F8000098, 'XThread01F0 (F8000098)', native=000001F0) +K> F8000098 AUDIT-HLC XThread::Execute tid=17 start_address=821748F0 start_context=BC365700 xapi=824AFF88 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800009C type=1 initial_state=1 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800009C kevent_va=3006E018 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A0 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000A0 kevent_va=30070018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A0 dst=F80000A8 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30072018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30072018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30072018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30072018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=8245802C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30072018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000A0 kevent_va=30070018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> F8000098 AUDIT-HLC ExCreateThread entry=821C4AD0 start_ctx=BCA44C00 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=821C4F64 +i> F8000098 XThreadF80000A0 (12) Stack: 70670000-70680000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F80000A0 XThread::Execute thid 18 (handle=F80000A0, 'XThread01F4 (F80000A0)', native=000001F4) +K> F80000A0 AUDIT-HLC XThread::Execute tid=18 start_address=821C4AD0 start_context=BCA44C00 xapi=824AFF88 +K> F80000A0 AUDIT-HLC ExCreateThread entry=822C6870 start_ctx=828F3300 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822C66F4 +i> F80000A0 XThreadF80000A8 (13) Stack: 706A0000-706D0000 +K> F80000A0 AUDIT-HLC ExCreateThread entry=822C6870 start_ctx=828F3300 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822C66F4 +i> F80000A0 XThreadF80000AC (14) Stack: 706F0000-70720000 +K> F80000A8 XThread::Execute thid 19 (handle=F80000A8, 'XThread01F8 (F80000A8)', native=000001F8) +K> F80000A8 AUDIT-HLC XThread::Execute tid=19 start_address=822C6870 start_context=828F3300 xapi=824AFF88 +K> F80000AC XThread::Execute thid 20 (handle=F80000AC, 'XThread01FC (F80000AC)', native=000001FC) +K> F80000AC AUDIT-HLC XThread::Execute tid=20 start_address=822C6870 start_context=828F3300 xapi=824AFF88 +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000B8 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000BC kevent_va=30080018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000BC dst=F80000C4 options=00000002 lr=824AA3B4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000C8 kevent_va=30082018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000C8 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000D4 kevent_va=30084018 lr=824A9F6C +K> F80000A0 AUDIT-HLC XEvent::Set handle=F80000D8 kevent_va=00000000 prio=1 lr=8244F5AC +K> F8000098 AUDIT-HLC XEvent::Set handle=F80000D8 kevent_va=00000000 prio=1 lr=8244F684 +K> F80000A0 AUDIT-HLC XEvent::Set handle=F80000D8 kevent_va=00000000 prio=1 lr=8244F684 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +F> F8000098 HostPathDevice::ResolvePath(\87719002\2\85d8849) +F> F8000098 HostPathDevice::ResolvePath(\87719002\2) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000D4 dst=F80000E4 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000E8 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000E8 kevent_va=30086018 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000E8 dst=F80000EC options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000F0 kevent_va=30088018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000F0 dst=F80000F8 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000FC kevent_va=3008A018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000FC dst=F8000104 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F8000108 kevent_va=3008C018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000098 HostPathDevice::ResolvePath(\87719002\0) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F8000108 dst=F8000110 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000F0 alertable=0 lr=824AC578 guest_lr=821C515C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000114 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=3008E018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000BC kevent_va=30080018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=30082018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=30084018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000EC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000E8 dst=F80000B4 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F8 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000F0 kevent_va=30088018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000F0 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000104 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000FC kevent_va=3008A018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000108 kevent_va=3008C018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000E8 dst=F8000094 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=824563E0 start_ctx=828F3E70 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82456A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +i> F8000008 XThreadF80000C0 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F80000C0 XThread::Execute thid 21 (handle=F80000C0, 'XThread0200 (F80000C0)', native=00000200) +K> F80000C0 AUDIT-HLC XThread::Execute tid=21 start_address=824563E0 start_context=828F3E70 xapi=824AFF88 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=3006A018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=82170430 start_ctx=828F4070 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82170260 +i> F8000008 XThreadF80000B8 (16) Stack: 70600000-70610000 +K> F80000B8 XThread::Execute thid 22 (handle=F80000B8, 'XThread0204 (F80000B8)', native=00000204) +K> F80000B8 AUDIT-HLC XThread::Execute tid=22 start_address=82170430 start_context=828F4070 xapi=824AFF88 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000CC kevent_va=30086018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=30086018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F80000B8 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000D0 dst=F80000DC options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000D0 dst=F80000DC options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000E4 kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000D0 dst=F80000DC options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E0 kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E8 kevent_va=30098018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E8 kevent_va=30098018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30098018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E8 kevent_va=30098018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E8 kevent_va=30098018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30098018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E8 kevent_va=30098018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E8 kevent_va=30098018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30098018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E8 kevent_va=30098018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000EC kevent_va=3009A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E8 kevent_va=30098018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30098018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDE30 start_ctx=828F3C4C xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=823DDDB4 +i> F8000008 XThreadF80000F4 (17) Stack: 70630000-70640000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E8 kevent_va=30098018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E8 kevent_va=30098018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30098018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E8 kevent_va=30098018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E8 kevent_va=30098018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30098018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E8 kevent_va=30098018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E8 kevent_va=30098018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30098018 prio=0 lr=824AAFC8 +K> F80000F4 XThread::Execute thid 23 (handle=F80000F4, 'XThread0208 (F80000F4)', native=00000208) +K> F80000F4 AUDIT-HLC XThread::Execute tid=23 start_address=823DDE30 start_context=828F3C4C xapi=824AFF88 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000E8 kevent_va=30098018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000F8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000F8 kevent_va=300A2018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000E8 kevent_va=30098018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E8 kevent_va=30098018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDB50 start_ctx=828F3C88 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=823DD924 +i> F8000008 XThreadF80000E8 (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDB50 start_ctx=828F3C88 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=823DD924 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +i> F8000008 XThreadF8000110 (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F80000E8 XThread::Execute thid 24 (handle=F80000E8, 'XThread020C (F80000E8)', native=0000020C) +K> F80000E8 AUDIT-HLC XThread::Execute tid=24 start_address=823DDB50 start_context=828F3C88 xapi=824AFF88 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000110 XThread::Execute thid 25 (handle=F8000110, 'XThread0210 (F8000110)', native=00000210) +K> F8000110 AUDIT-HLC XThread::Execute tid=25 start_address=823DDB50 start_context=828F3C88 xapi=824AFF88 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=82172DF4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300A8018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300A8018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300A8018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000CC kevent_va=3007E018 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000CC dst=F80000D0 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30086018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000CC dst=F80000D0 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000CC dst=F80000D0 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D0 kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D0 kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D0 kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D0 kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D0 kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=821CC1B8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=00000000 prio=1 lr=823DF714 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827EED8C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827ED704 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827ED908 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827ECBB8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E9C9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E9C9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E9C9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800009C kevent_va=3006E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000BC kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000BC kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=821CC1B8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800009C kevent_va=3006E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000BC kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=821748F0 start_ctx=BC368FA0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=82174828 +i> F8000008 XThreadF80000CC (1A) Stack: 70880000-70900000 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F80000CC XThread::Execute thid 26 (handle=F80000CC, 'XThread0214 (F80000CC)', native=00000214) +K> F80000CC AUDIT-HLC XThread::Execute tid=26 start_address=821748F0 start_context=BC368FA0 xapi=824AFF88 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=1 lr=824A9F6C +K> F80000CC AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=300A8018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F80000CC AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=300B0018 lr=824A9F6C +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000CC AUDIT-HLC NtDuplicateObject src=F80000DC dst=F8000114 options=00000002 lr=824AA3B4 +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000118 kevent_va=300B2018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B2018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000118 kevent_va=300B2018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000118 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000118 lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B2018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000118 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=300B0018 prio=0 lr=824AA304 +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000088 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +F> F8000088 DiscImageDevice::ResolvePath(\dat) +K> F8000088 AUDIT-HLC NtDuplicateObject src=F8000104 dst=F8000118 options=00000002 lr=824AA3B4 +K> F8000088 AUDIT-HLC NtSetEvent handle=F8000118 lr=824AA304 guest_lr=82460078 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000104 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000104 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=00000000 prio=1 lr=82178D9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=00000000 prio=1 lr=82178D9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=00000000 prio=1 lr=82178D9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=00000000 prio=1 lr=82178D9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=00000000 prio=1 lr=82178D9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000104 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=00000000 prio=1 lr=824D11A0 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=00000000 prio=1 lr=82178D9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F80000CC AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=00000000 prio=1 lr=8217C6F4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000BC kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000BC kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000118 kevent_va=30080018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800011C kevent_va=30086018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000120 kevent_va=300B0018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000124 kevent_va=300B2018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000128 kevent_va=300B4018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800012C kevent_va=300B6018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000130 kevent_va=300B8018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000134 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000134 kevent_va=300BA018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800013C kevent_va=300BC018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000140 kevent_va=300BE018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000144 kevent_va=300C0018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000148 kevent_va=300C2018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800014C kevent_va=300C4018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000150 kevent_va=300C6018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000154 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000154 kevent_va=300C8018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000158 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000158 kevent_va=300CA018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC ExCreateThread entry=82506528 start_ctx=BCE25340 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +i> F8000008 XThreadF800015C (1B) Stack: 70880000-70890000 +K> F8000008 AUDIT-HLC ExCreateThread entry=82506558 start_ctx=BCE25340 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF8000160 (1C) Stack: 708B0000-708C0000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC ExCreateThread entry=82506588 start_ctx=BCE25340 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF8000164 (1D) Stack: 708E0000-708F0000 +K> F8000008 AUDIT-HLC ExCreateThread entry=825065B8 start_ctx=BCE25340 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +i> F8000008 XThreadF8000168 (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=00000000 prio=1 lr=824D09C4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=00000000 prio=1 lr=824D091C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=82172DF4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82507ABC +K> F8000160 XThread::Execute thid 28 (handle=F8000160, 'XThread021C (F8000160)', native=0000021C) +K> F8000160 AUDIT-HLC XThread::Execute tid=28 start_address=82506558 start_context=BCE25340 xapi=824AFF88 +K> F800015C XThread::Execute thid 27 (handle=F800015C, 'XThread0218 (F800015C)', native=00000218) +K> F800015C AUDIT-HLC XThread::Execute tid=27 start_address=82506528 start_context=BCE25340 xapi=824AFF88 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000164 XThread::Execute thid 29 (handle=F8000164, 'XThread0220 (F8000164)', native=00000220) +K> F8000164 AUDIT-HLC XThread::Execute tid=29 start_address=82506588 start_context=BCE25340 xapi=824AFF88 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827ED1E4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E9C9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000164 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=00000000 prio=1 lr=824D0978 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300BE018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C0018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=00000000 prio=1 lr=827E843C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C2018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C4018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300C6018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000154 kevent_va=300C8018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000154 kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F8000158 kevent_va=300CA018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F8000158 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000088 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=00000000 prio=1 lr=824D0868 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000160 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300BC018 lr=824AAFC8 +K> F8000160 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300B6018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000130 kevent_va=300B8018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000130 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BA018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=30080018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=30086018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F800011C kevent_va=30086018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B0018 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800015C AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B2018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B4018 lr=824AAFC8 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000160 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000188 kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC XEvent::Set handle=F8000184 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C diff --git a/audit-runs/audit-059-handle-disambiguation/round-A7-canary-entry-point/canary.stdout b/audit-runs/audit-059-handle-disambiguation/round-A7-canary-entry-point/canary.stdout new file mode 100644 index 0000000..95079a7 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round-A7-canary-entry-point/canary.stdout @@ -0,0 +1,59504 @@ +i> 000000D4 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D4 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D4 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = true +audit_jit_prolog_mem_dump = 0 +audit_jit_prolog_pc = 2182918192 +audit_jit_prolog_r3_bytes = 64 +audit_track_event_handle = 0 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D4 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D4 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D4 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +i> 00000124 Setup: Initializing Memory... +i> 00000124 Setup: Initializing Exports... +i> 00000124 Setup: Initializing Processor... +i> 00000124 Setup: Initializing Audio... +i> 00000124 Setup: Initializing Graphics... +i> 00000124 Setup: Initializing HID... +i> 00000124 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000124 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000124 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000124 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000124 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000124 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000124 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000124 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000124 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000124 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000124 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000124 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000124 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000124 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000124 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000124 winkey: "L" binds key 0x4C to controller input X. +i> 00000124 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000124 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000124 winkey: "P" binds key 0x50 to controller input Y. +i> 00000124 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000124 winkey: "X" binds key 0x58 to controller input START. +i> 00000124 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000124 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D4 SDL Version 2.32.2 initialized. +w> 000000D4 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000124 Setup: Initializing VFS... +i> 00000124 PatchDB: Loaded patches for 0 titles +i> 00000124 Setup: Initializing Kernel... +i> 00000124 ProfileManager: Found 0 Profiles +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +K> 00000124 AUDIT-HLC XEvent::Set handle=F8000000 kevent_va=00000000 prio=1 lr=00000000 +i> 00000124 Setup: Starting graphics_system... +i> 00000124 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000124 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000124 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000124 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000124 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000154, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=00000158, ) +i> 00000124 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000124 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000180, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000184, ) +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Loading module GAME:\default.xex +F> 000000D4 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D4 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D4 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D4 Title name: PROJECT SYLPHEED +i> 000000D4 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D4 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D4 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D4 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D4 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D4 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D4 KernelState: Launching module... +i> 000000D4 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000190, ) +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000194) +K> F8000008 AUDIT-HLC XThread::Execute tid=6 start_address=824AB748 start_context=00000000 xapi=00000000 +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +K> F8000008 AUDIT-HLC JitProlog pc=824AB748 tid=00000006 r3=00000000 r4=00000000 r5=00000000 r6=00000000 r7=00000000 r8=00000000 r9=00000000 r10=00000000 lr=BCBCBCBC +K> F8000008 AUDIT-HLC JitProlog pc=824AB748 r3 out of VA range, skipping dump +i> 01000010 Translated 7 shaders in 4 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800000C kevent_va=30029018 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01B8 (F8000010)', native=000001B8) +K> F8000010 AUDIT-HLC XThread::Execute tid=7 start_address=824A93C8 start_context=828A28F0 xapi=00000000 +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000010 AUDIT-HLC XEvent::Set handle=F8000014 kevent_va=00000000 prio=1 lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000020 kevent_va=3002F018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=82181830 start_ctx=828F3D08 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=821817FC +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01BC (F8000024)', native=000001BC) +K> F8000024 AUDIT-HLC XThread::Execute tid=8 start_address=82181830 start_context=828F3D08 xapi=824AFF88 +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +K> F8000008 AUDIT-HLC ExCreateThread entry=8245A5D0 start_ctx=828F4838 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=824592B4 +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C0 (F800002C)', native=000001C0) +K> F800002C AUDIT-HLC XThread::Execute tid=9 start_address=8245A5D0 start_context=828F4838 xapi=824AFF88 +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F800002C HostPathDevice::ResolvePath() +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=00000000 prio=1 lr=8245ADEC +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800003C kevent_va=3003B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000040 kevent_va=3003D018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=82450A28 start_ctx=828F3B68 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82450034 +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C4 (F8000048)', native=000001C4) +K> F8000048 AUDIT-HLC XThread::Execute tid=10 start_address=82450A28 start_context=828F3B68 xapi=824AFF88 +K> F8000008 AUDIT-HLC NtDuplicateObject src=F800003C dst=F800004C options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000050 kevent_va=30045018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000050 kevent_va=30045018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000050 kevent_va=30045018 prio=0 lr=824AAFC8 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800003C kevent_va=3003B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000038 kevent_va=3003B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000038 dst=F800003C options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F800004C kevent_va=30045018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F800004C kevent_va=30045018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800004C kevent_va=30045018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F800004C kevent_va=30045018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000050 kevent_va=30047018 lr=824A9F6C +K> F8000048 AUDIT-HLC ExCreateThread entry=82457EF0 start_ctx=828F3B08 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82457EA0 +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01C8 (F8000058)', native=000001C8) +K> F8000058 AUDIT-HLC XThread::Execute tid=11 start_address=82457EF0 start_context=828F3B08 xapi=824AFF88 +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F800004C kevent_va=30045018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=3003B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000038 kevent_va=30045018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=824CD458 start_ctx=BE56BB3C xapi=00000000 flags=04000080 lr=824CD984 guest_lr=824C1AD8 +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01CC (F800004C)', native=000001CC) +K> F800004C AUDIT-HLC XThread::Execute tid=12 start_address=824CD458 start_context=BE56BB3C xapi=00000000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC singleton[0x828E1F08]=BC22C910 vtable=820A183C vtable[0]=82175330 vtable[24]=82175378 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000060 kevent_va=30053018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000064 kevent_va=30055018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=822F1EE0 start_ctx=BCE24A40 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822F1B0C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D0 (F8000068)', native=000001D0) +K> F8000068 AUDIT-HLC XThread::Execute tid=13 start_address=822F1EE0 start_context=BCE24A40 xapi=824AFF88 +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000070 kevent_va=3005B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000070 dst=F8000074 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000078 kevent_va=3005D018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> F8000048 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=8245802C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000070 kevent_va=3005B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000070 kevent_va=3005B018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000070 dst=F8000074 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000078 kevent_va=3005D018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000078 kevent_va=3005D018 lr=824A9F6C +K> F8000048 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=8245802C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=3005D018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000070 kevent_va=3005B018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC ExCreateThread entry=824D2878 start_ctx=00000000 xapi=00000000 flags=10000001 lr=824D2E68 guest_lr=824D059C +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +K> F8000008 AUDIT-HLC ExCreateThread entry=824D2940 start_ctx=00000000 xapi=00000000 flags=20000001 lr=824D2E68 guest_lr=824D059C +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D4 (F8000070)', native=000001D4) +K> F8000070 AUDIT-HLC XThread::Execute tid=14 start_address=824D2878 start_context=00000000 xapi=00000000 +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01D8 (F8000074)', native=000001D8) +K> F8000074 AUDIT-HLC XThread::Execute tid=15 start_address=824D2940 start_context=00000000 xapi=00000000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x718d63020040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827EB9A4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30064018 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30066018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtDuplicateObject src=F800008C dst=F8000094 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30064018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30064018 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtDuplicateObject src=F800008C dst=F8000094 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 guest_lr=82460078 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30064018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30064018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtDuplicateObject src=F800008C dst=F8000094 options=00000002 lr=824AA3B4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30066018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30066018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30066018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30064018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827E8E68 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC ExCreateThread entry=82178950 start_ctx=828F3EC0 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82178F08 +i> F8000008 XThreadF800008C (10) Stack: 705A0000-705B0000 +K> F800008C XThread::Execute thid 16 (handle=F800008C, 'XThread01EC (F800008C)', native=000001EC) +K> F800008C AUDIT-HLC XThread::Execute tid=16 start_address=82178950 start_context=828F3EC0 xapi=824AFF88 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=82173BF0 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=821748F0 start_ctx=BC365700 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=82174828 +i> F8000008 XThreadF8000098 (11) Stack: 705D0000-70650000 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000098 XThread::Execute thid 17 (handle=F8000098, 'XThread01F0 (F8000098)', native=000001F0) +K> F8000098 AUDIT-HLC XThread::Execute tid=17 start_address=821748F0 start_context=BC365700 xapi=824AFF88 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800009C type=1 initial_state=1 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800009C kevent_va=3006E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A0 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000A0 kevent_va=30070018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A0 dst=F80000A8 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30072018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30072018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30072018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30072018 lr=824A9F6C +K> F8000048 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=8245802C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30072018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000A0 kevent_va=30070018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> F8000098 AUDIT-HLC ExCreateThread entry=821C4AD0 start_ctx=BCA44C00 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=821C4F64 +i> F8000098 XThreadF80000A0 (12) Stack: 70670000-70680000 +K> F80000A0 XThread::Execute thid 18 (handle=F80000A0, 'XThread01F4 (F80000A0)', native=000001F4) +K> F80000A0 AUDIT-HLC XThread::Execute tid=18 start_address=821C4AD0 start_context=BCA44C00 xapi=824AFF88 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F80000A0 AUDIT-HLC ExCreateThread entry=822C6870 start_ctx=828F3300 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822C66F4 +i> F80000A0 XThreadF80000A8 (13) Stack: 706A0000-706D0000 +K> F80000A0 AUDIT-HLC ExCreateThread entry=822C6870 start_ctx=828F3300 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822C66F4 +i> F80000A0 XThreadF80000AC (14) Stack: 706F0000-70720000 +K> F80000A8 XThread::Execute thid 19 (handle=F80000A8, 'XThread01F8 (F80000A8)', native=000001F8) +K> F80000A8 AUDIT-HLC XThread::Execute tid=19 start_address=822C6870 start_context=828F3300 xapi=824AFF88 +K> F80000AC XThread::Execute thid 20 (handle=F80000AC, 'XThread01FC (F80000AC)', native=000001FC) +K> F80000AC AUDIT-HLC XThread::Execute tid=20 start_address=822C6870 start_context=828F3300 xapi=824AFF88 +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000B8 options=00000002 lr=824AA3B4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000BC kevent_va=30080018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000BC dst=F80000C4 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000C8 kevent_va=30082018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000C8 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000D8 kevent_va=30084018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\2\85d8849) +F> F8000098 HostPathDevice::ResolvePath(\87719002\2) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000D8 dst=F80000E4 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000E0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30086018 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000E0 dst=F80000E8 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000EC kevent_va=30088018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000EC dst=F80000F4 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000F8 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000F8 kevent_va=3008A018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000F8 dst=F8000100 options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F8000104 kevent_va=3008C018 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000098 HostPathDevice::ResolvePath(\87719002\0) +K> F8000098 AUDIT-HLC NtDuplicateObject src=F8000104 dst=F800010C options=00000002 lr=824AA3B4 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000EC alertable=0 lr=824AC578 guest_lr=821C515C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3008E018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000BC kevent_va=30080018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=30082018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D8 kevent_va=30084018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E8 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B4 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000E0 dst=F80000B4 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3008E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3008E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3008E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000EC kevent_va=30088018 prio=0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000EC result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000100 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000F8 kevent_va=3008A018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800010C lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000104 kevent_va=3008C018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000094 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000E0 dst=F8000094 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000098 kevent_va=30068018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30068018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30068018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000B8 kevent_va=3006A018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000B8 kevent_va=3006A018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B8 kevent_va=3006A018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC ExCreateThread entry=824563E0 start_ctx=828F3E70 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82456A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +i> F8000008 XThreadF80000B8 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F80000B8 XThread::Execute thid 21 (handle=F80000B8, 'XThread0200 (F80000B8)', native=00000200) +K> F80000B8 AUDIT-HLC XThread::Execute tid=21 start_address=824563E0 start_context=828F3E70 xapi=824AFF88 +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=30088018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=30088018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=30088018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000E0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=30088018 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC ExCreateThread entry=82170430 start_ctx=828F4070 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82170260 +i> F8000008 XThreadF80000C0 (16) Stack: 70600000-70610000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F80000C0 XThread::Execute thid 22 (handle=F80000C0, 'XThread0204 (F80000C0)', native=00000204) +K> F80000C0 AUDIT-HLC XThread::Execute tid=22 start_address=82170430 start_context=828F4070 xapi=824AFF88 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000CC kevent_va=30086018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000CC kevent_va=30086018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F80000C0 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000D0 dst=F80000D4 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000D0 dst=F80000D4 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=30096018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000D0 dst=F80000D4 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000DC kevent_va=30094018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000DC kevent_va=30094018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000DC kevent_va=30094018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000E8 kevent_va=3009A018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDE30 start_ctx=828F3C4C xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=823DDDB4 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000F0 kevent_va=300A0018 lr=824A9F6C +i> F8000008 XThreadF80000EC (17) Stack: 70630000-70640000 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000F0 kevent_va=300A0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000F0 kevent_va=300A0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000F0 kevent_va=300A0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000F0 kevent_va=300A0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000F0 kevent_va=300A0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000F0 kevent_va=300A0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000F0 kevent_va=300A0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000F0 kevent_va=300A0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000F0 kevent_va=300A0018 lr=824A9F6C +K> F80000EC XThread::Execute thid 23 (handle=F80000EC, 'XThread0208 (F80000EC)', native=00000208) +K> F80000EC AUDIT-HLC XThread::Execute tid=23 start_address=823DDE30 start_context=828F3C4C xapi=824AFF88 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000F0 kevent_va=300A0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000F0 kevent_va=300A0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000F0 kevent_va=300A0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000F0 kevent_va=300A0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000F0 kevent_va=300A0018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000F4 kevent_va=300A2018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDB50 start_ctx=828F3C88 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=823DD924 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +i> F8000008 XThreadF80000FC (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC ExCreateThread entry=823DDB50 start_ctx=828F3C88 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=823DD924 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +i> F8000008 XThreadF800010C (19) Stack: 707E0000-70860000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F80000FC XThread::Execute thid 24 (handle=F80000FC, 'XThread020C (F80000FC)', native=0000020C) +K> F80000FC AUDIT-HLC XThread::Execute tid=24 start_address=823DDB50 start_context=828F3C88 xapi=824AFF88 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F800010C XThread::Execute thid 25 (handle=F800010C, 'XThread0210 (F800010C)', native=00000210) +K> F800010C AUDIT-HLC XThread::Execute tid=25 start_address=823DDB50 start_context=828F3C88 xapi=824AFF88 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=82172DF4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000D0 dst=F80000D4 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300A7018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300A7018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300A7018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000D0 dst=F80000B0 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D4 kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D4 kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D4 kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D4 kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D4 kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D4 kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtDuplicateObject src=F80000D0 dst=F80000B0 options=00000002 lr=824AA3B4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D4 kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D4 kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D4 kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D4 kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D4 kevent_va=3007E018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D4 kevent_va=3007E018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=3007E018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D0 kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AAFC8 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D0 kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D0 kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D0 kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=30086018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F80000D0 kevent_va=30086018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D0 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtDuplicateObject src=F80000B0 dst=F80000D0 options=00000002 lr=824AA3B4 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82460EC0 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=821CC1B8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800008C AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827EED8C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827E843C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827ED704 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827E843C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800008C AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827ECBB8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827E843C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800009C kevent_va=3006E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=821CC1B8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=00000000 prio=1 lr=824D0868 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800009C kevent_va=3006E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000BC kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC ExCreateThread entry=821748F0 start_ctx=BC3690A0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=82174828 +i> F8000008 XThreadF80000CC (1A) Stack: 70880000-70900000 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000CC XThread::Execute thid 26 (handle=F80000CC, 'XThread0214 (F80000CC)', native=00000214) +K> F80000CC AUDIT-HLC XThread::Execute tid=26 start_address=821748F0 start_context=BC3690A0 xapi=824AFF88 +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=1 lr=824A9F6C +K> F80000CC AUDIT-HLC NtCreateEvent_inner handle=F80000D0 kevent_va=300A7018 lr=824A9F6C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F80000CC AUDIT-HLC NtCreateEvent_inner handle=F80000D4 kevent_va=300B0018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000CC AUDIT-HLC NtDuplicateObject src=F80000D4 dst=F8000110 options=00000002 lr=824AA3B4 +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D4 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000114 kevent_va=300B2018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=300B2018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000114 kevent_va=300B2018 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=8245802C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000114 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 guest_lr=82457F18 +K> F8000058 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=300B2018 prio=0 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000114 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 guest_lr=82450DF4 +K> F8000048 AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=300B0018 prio=0 lr=824AA304 +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D4 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800008C AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F800008C AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +F> F800008C DiscImageDevice::ResolvePath(\dat) +K> F800008C AUDIT-HLC NtDuplicateObject src=F8000100 dst=F8000114 options=00000002 lr=824AA3B4 +K> F800008C AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 guest_lr=82460078 +K> F800008C AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000100 alertable=0 lr=824AC578 guest_lr=82460150 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000100 result=00000000 lr=824AC578 guest_lr=82460150 +K> F800008C AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=00000000 prio=1 lr=82178D9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=00000000 prio=1 lr=82178D9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=00000000 prio=1 lr=82178D9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=00000000 prio=1 lr=82178D9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=00000000 prio=1 lr=82178D9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=300B0018 lr=824A9F6C +K> F8000048 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=300B0018 lr=824AAFC8 +K> F8000048 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=00000000 prio=1 lr=824D0978 +K> F8000070 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800008C AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=00000000 prio=1 lr=82178D9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F80000CC AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=00000000 prio=1 lr=8217C6F4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000BC kevent_va=3007E018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 guest_lr=822F1FC8 +K> F8000068 AUDIT-HLC XEvent::Set handle=F80000BC kevent_va=3007E018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000100 kevent_va=30080018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000114 kevent_va=30086018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000118 kevent_va=300B0018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800011C kevent_va=300B2018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000120 kevent_va=300B4018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000124 kevent_va=300B6018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000128 kevent_va=300B8018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800012C kevent_va=300BA018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000134 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000134 kevent_va=300BC018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000138 kevent_va=300BE018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800013C kevent_va=300C0018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000140 kevent_va=300C2018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000144 kevent_va=300C4018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000148 kevent_va=300C6018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800014C kevent_va=300C8018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000150 kevent_va=300CA018 lr=824A9F6C +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC ExCreateThread entry=82506528 start_ctx=BCE25340 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF8000154 (1B) Stack: 70880000-70890000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC ExCreateThread entry=82506558 start_ctx=BCE25340 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF8000158 (1C) Stack: 708B0000-708C0000 +K> F8000008 AUDIT-HLC ExCreateThread entry=82506588 start_ctx=BCE25340 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF800015C (1D) Stack: 708E0000-708F0000 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC ExCreateThread entry=825065B8 start_ctx=BCE25340 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 +i> F8000008 XThreadF8000160 (1E) Stack: 70910000-70920000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=00000000 prio=1 lr=824D09C4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=00000000 prio=1 lr=824D091C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=82172DF4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=30045018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000170 kevent_va=00000000 prio=1 lr=82507ABC +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 XThread::Execute thid 28 (handle=F8000158, 'XThread021C (F8000158)', native=0000021C) +K> F8000158 AUDIT-HLC XThread::Execute tid=28 start_address=82506558 start_context=BCE25340 xapi=824AFF88 +K> F8000154 XThread::Execute thid 27 (handle=F8000154, 'XThread0218 (F8000154)', native=00000218) +K> F8000154 AUDIT-HLC XThread::Execute tid=27 start_address=82506528 start_context=BCE25340 xapi=824AFF88 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F800015C XThread::Execute thid 29 (handle=F800015C, 'XThread0220 (F800015C)', native=00000220) +K> F800015C AUDIT-HLC XThread::Execute tid=29 start_address=82506588 start_context=BCE25340 xapi=824AFF88 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827ECE30 +K> F8000070 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=00000000 prio=1 lr=824D08C0 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827E843C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827E843C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827ECE30 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827E843C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=00000000 prio=1 lr=824D0868 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000088 kevent_va=00000000 prio=1 lr=827E843C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000100 kevent_va=30080018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000100 kevent_va=30080018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30086018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30086018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000074 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000068 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 0100001C AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000070 AUDIT-HLC XEvent::Set handle=F8000080 kevent_va=00000000 prio=1 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=824BEAAC +K> 01000014 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30053018 prio=0 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C +K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC XEvent::Set handle=F8000064 kevent_va=30055018 prio=0 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 diff --git a/audit-runs/audit-059-handle-disambiguation/round-A8-ours-822F1AA8-trace/FINDINGS.md b/audit-runs/audit-059-handle-disambiguation/round-A8-ours-822F1AA8-trace/FINDINGS.md new file mode 100644 index 0000000..3df95cf --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round-A8-ours-822F1AA8-trace/FINDINGS.md @@ -0,0 +1,136 @@ +# Phase A synthesis — canary tid=6 IS the main thread; the wedge is sub_822F1AA8's loop exit + +## Top-line finding + +**Canary's `tid=6` is canary's main thread.** Confirmed by probing `entry_point` +(`sub_824AB748`) with `--audit_jit_prolog_pc=0x824AB748`: fires 1× on +`tid=00000006` with `lr=BCBCBCBC` (= OS-initial / no caller). Ours numbers +its main thread `tid=1`. Same logical thread; different label. + +Therefore "tid=6 fires sub_821741C8 471×" (round 33) means **the main thread** +loops inside `sub_822F1AA8` firing `sub_821741C8` ~1678×/30s in canary. In +ours, the main thread (tid=1) runs `sub_822F1AA8` ONCE, exits the loop, and +proceeds to thread-join on the spawned init thread (handle 0x1070 = tid=13), +which is itself blocked forever on handle 0x1078. + +## Call chain (identical in both engines, different runtime behavior) + +``` +entry_point (sub_824AB748) + │ + ├─ sub_824ACB38 CRT-driven fnptr-array iterator (audit-050 region) + ├─ ... + └─ sub_8216EA68 Many local calls including: + ├─ ExCreateThread(entry=sub_8217F0F8 ...) ; sibling thread + ├─ sub_822F1AA8(controller=...) ; FIRST call (PC 0x8216ECCC) + └─ sub_822F1AA8(controller=0xBCE24A40 canary / ; SECOND call (PC 0x8216EE10) + 0x40d09a40 ours) ↑ this is the loop +``` + +The SECOND call is what runs the dispatcher loop. Its LR = 0x8216EE14. +Confirmed in both engines. + +## sub_822F1AA8 loop structure + +``` +0x822F1AA8: entry, r30 = r3 (controller) +0x822F1AEC-0x822F1B08: ExCreateThread(entry=sub_822F1EE0, ctx=r30) → r29 = handle +0x822F1B30-0x822F1B34: bl 0x824AA8B0(r3=r29) ; ? +0x822F1B38-0x822F1B4C: first bctrl → vtable[+0] of [0x828E1F08] +0x822F1B50-0x822F1B74: setup, bl 0x824AA330 INFINITE wait on [r22+32] +0x822F1B80-0x822F1BA8: post-wait setup; [r30+0] |= 0x2 +0x822F1BB0-0x822F1BBC: TOP-OF-LOOP CHECK: if [r30+0] & 0x10000000 → goto 0x822F1E10 (exit) +0x822F1BCC..0x822F1DEC: loop body (includes the vtable[+8] bctrl → sub_821741C8 at PC 0x822F1D58) +0x822F1DEC-0x822F1DFC: bl 0x824AA330 INFINITE wait on [r23+0] +0x822F1E00-0x822F1E0C: END-OF-ITERATION CHECK: if [r30+0] & 0x10000000 == 0 → goto 0x822F1BCC (re-loop) +0x822F1E10-0x822F1E18: EXIT: [r30+0] |= 0x02000000 (set MSB-6 = LSB-25) +0x822F1E1C-0x822F1E24: release something via bl 0x824AA2F0 +0x822F1E28-0x822F1E30: bl 0x824AA330 INFINITE on [r30+28] = SPAWNED THREAD HANDLE (thread join!) +0x822F1E40: bl 0x824AA3E0 +0x822F1E44-0x822F1E5C: final cleanup: vtable[+24] bctrl on [0x828E1F08] +0x822F1E60-0x822F1E78: [r30+0] = 0, then [r30+0] |= 1; bl 0x824567E0 +0x822F1E7C-0x822F1E88: epilogue +``` + +**Loop exit gate**: `[r30+0] & 0x10000000` (bit 28 LSB / bit 3 MSB). Set → +exit. Both top-of-loop check (0x822F1BBC) and end-of-iteration check +(0x822F1E0C) gate on the same bit. + +## What's different between engines + +| Engine | [r30+0] at entry | Loop iterations | Exits sub_822F1AA8? | +|--------|------------------|------------------|----------------------| +| canary | 0x21 (per probe) | ~1678+ in 30s | NO (stays in loop) | +| ours | 0x21 (per probe) | 0 (probes show none of the loop-body PCs fire after entry) | YES (exits quickly) | + +Both engines have `[r30+0]=0x21` at entry — bit 28 NOT set. After the `ori +r11, r11, 0x2` at 0x822F1B90, both should have `[r30+0]=0x23`. Bit 28 still +not set. + +So **some code sets bit 28 on [r30+0] between sub_822F1AA8 entry and the +loop check** in ours but not in canary. + +Mem-watch on 0x40d09a40 (ours' controller VA) shows **zero guest writes** in +my 50M-instruction parallel run. Possible reasons: +- The setter writes from kernel/runtime code that mem-watch doesn't capture + (kernel-host store, not guest JIT store) +- The setter writes via a computed alias (different VA but same backing) +- The bit IS set via a probe-quantum-elided JIT store + +## Phase B classification + +**Class 3a — state-divergence on the controller object**. The vtable +identity is the same (round-37 confirmed `0x820A183C` in both). The +controller object's bit 28 of `[+0]` evolves differently during the setup +between sub_822F1AA8 entry and the loop check. + +Class 4 (synthesis) is now LESS attractive: ours' main thread DOES reach +sub_822F1AA8 with the right controller. We don't need to spawn the +dispatcher — we need to PREVENT the main thread from exiting the loop. + +## Pragmatic next step — JIT instrumentation to find bit-28 setter + +Most direct diagnostic: add a JIT hook in xenia-cpu that, for guest stores +in the range [0x822F1AA8, 0x822F1E10), captures the guest PC + the written +value when the store would set bit 28 of any address. This identifies the +exact PC that sets the loop-exit bit. + +Alternative: extend `--mem-watch` to also capture kernel-side stores by +hooking the GuestMemory write path at the kernel-state level. + +Even simpler: add a one-shot `--bit-watch=ADDR:MASK` cvar that fires when +the value at ADDR has any bit in MASK transition from 0→1, regardless of +who wrote it. This is the cleanest diagnostic for this exact pattern. + +## Fix shape (when bit-28 setter is identified) + +If the bit-28 setter is inside the vtable[+0] dispatch chain at 0x822F1B4C +(target sub_82173990), then the fix might be a state-init issue in the +kernel/runtime. + +If the bit-28 setter is inside the inner wait or one of the kernel calls +(`bl 0x824AA8B0`, `bl 0x824AA330`), the fix might be a missing event signal +or a wrong handle-state evolution. + +If we can't identify the setter cleanly, the synthesis fallback is to +**inject a kernel-side hook that clears bit 28 of [r30+0] on every entry to +sub_822F1AA8's bit-check site (0x822F1BB0)**. Crude but should keep the +main thread in the loop. + +## Why this is a clearer wedge picture than rounds 22-33 + +Rounds 22-33 chased the audit-049 wedge from various angles. The diagnoses +landed on different layers: +- R22: "wrong cluster targeted" (cluster A vs B) +- R26-30: "state-machine progression bug" +- R32-33: "pool 3 starvation; bootstrap walk-back" + +This round establishes the simplest possible framing: + +> **Canary's main thread loops forever in a dispatcher; ours' main thread +> exits the loop after one setup phase. The exit is gated by a single bit +> on the controller's flag word.** + +If bit 28 of `[controller+0]` could be permanently cleared, ours' main +thread would stay in the loop, sub_821741C8 would dispatch, signals would +flow, tid=13 would complete, draws would happen. diff --git a/audit-runs/audit-059-handle-disambiguation/round-A8-ours-822F1AA8-trace/ours.log b/audit-runs/audit-059-handle-disambiguation/round-A8-ours-822F1AA8-trace/ours.log new file mode 100644 index 0000000..2686453 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round-A8-ours-822F1AA8-trace/ours.log @@ -0,0 +1,79 @@ +AUDIT-PC-PROBE pc=0x822f1aa8 tid=1 hw=0 cycle=6180796 lr=0x8216ee14 r3=0x40d09a40 r11=0x40111910 [r3+0]=0x00000021 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x40541a40 [r3+0x30]=0x00000000 +AUDIT-PC-PROBE pc=0x822f1b38 tid=1 hw=0 cycle=6181181 lr=0x822f1b38 r3=0x00000001 r11=0x824b0000 [r3+0]=0x00000000 [[r3+0]+24]=0x00000000 [r3+0x0C]=0x00000000 [r3+0x30]=0x00000000 + +=== Final State === +PC: 0x824ac578 +LR: 0x824ac578 +CTR: 0x82153bf0 +CR: 0x24000028 +XER: CA=0 OV=0 SO=0 +r0 : 0x0000000082153bf0 +r1 : 0x00000000700ff6e0 +r2 : 0x0000000020000000 +r4 : 0x0000000000000001 +r7 : 0x0000000003a72328 +r8 : 0x0000000043b77284 +r9 : 0x0000000043b77328 +r10: 0x0000000000000001 +r11: 0x0000000000000103 +r12: 0x0000000082173c64 +r13: 0x000000007fff0000 +r18: 0x0000000040d09a7c +r23: 0x00000000828f3844 +r26: 0x000000004024a4e0 +r27: 0x00000000820a17a8 +r31: 0x0000000000001070 + +=== Thread diagnostics === + hw=0 idx=0 tid=1 state=Blocked(WaitAny { handles: [4208], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x700ff6e0 + r0=0x82153bf0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a72328 + r8=0x43b77284 r9=0x43b77328 r10=0x00000001 r11=0x00000103 r12=0x82173c64 r13=0x7fff0000 + hw=0 idx=1 tid=11 state=Blocked(WaitAny { handles: [2190094916, 2190094880], deadline: None }) pc=0x824d2a94 lr=0x824d2a94 sp=0x71497d90 + r0=0x00000000 r3=0x00000000 r4=0x71497de0 r5=0x00000001 r6=0x00000003 r7=0x00000001 + r8=0x00000000 r9=0x00000000 r10=0x71497df0 r11=0x828a3244 r12=0xbcbcbcbc r13=0x4b9f1000 + hw=1 idx=0 tid=2 state=Blocked(WaitAny { handles: [2189887804], deadline: None }) pc=0x824a95f8 lr=0x824a95f8 sp=0x710ffd20 + r0=0x0000030c r3=0x00000000 r4=0x00000003 r5=0x00000001 r6=0x00000000 r7=0x00000000 + r8=0x00000001 r9=0x6f000000 r10=0x824a9178 r11=0x82870000 r12=0x824a94f0 r13=0x4acc3000 + hw=1 idx=1 tid=13 state=Blocked(WaitAny { handles: [4216], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x715a7a20 + r0=0x821511d0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a723d0 + r8=0x43b77334 r9=0x43b77334 r10=0x40541f80 r11=0x00000001 r12=0x821cb1e0 r13=0x4d1d4000 + hw=2 idx=0 tid=7 state=Blocked(WaitAny { handles: [1111821148], deadline: Some(42946672) }) pc=0x824cd4f4 lr=0x824cd4f4 sp=0x71187e60 + r0=0x00000000 r3=0x00000000 r4=0x00000003 r5=0x00000001 r6=0x00000000 r7=0x71187eb0 + r8=0x00000000 r9=0x00000000 r10=0x00000002 r11=0x00000002 r12=0xbcbcbcbc r13=0x4b1d6000 + hw=2 idx=1 tid=8 state=Blocked(WaitAny { handles: [4176, 4132], deadline: None }) pc=0x824ab214 lr=0x824ab214 sp=0x71287c90 + r0=0x00000000 r3=0x00000000 r4=0x71287cf0 r5=0x00000001 r6=0x00000001 r7=0x00000000 + r8=0x00000000 r9=0x00009030 r10=0x00000002 r11=0x00000020 r12=0x822f1ff0 r13=0x4b90a000 + hw=3 idx=0 tid=4 state=Blocked(WaitAny { handles: [4120], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x7112fb80 + r0=0x821511a0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a723d0 + r8=0x43b7732c r9=0x828f0000 r10=0x00000008 r11=0x00000000 r12=0x8245a660 r13=0x4adc6000 + hw=3 idx=1 tid=5 state=Blocked(WaitAny { handles: [4224], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x7116fbe0 + r0=0x821511a0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x03a723d0 + r8=0x43b7732c r9=0x828f0000 r10=0x00000001 r11=0x00000000 r12=0x82458b34 r13=0x4adc8000 + hw=4 idx=0 tid=9 state=Ready pc=0x824d1404 lr=0x824d22b4 sp=0x71387df0 + r0=0x00000000 r3=0x4250dedc r4=0x4250e040 r5=0x00000001 r6=0x00000000 r7=0x00000000 + r8=0x4b9ec000 r9=0x01010000 r10=0x01010000 r11=0x00000000 r12=0x824d22a8 r13=0x4b9ec000 + hw=5 idx=0 tid=3 state=Blocked(WaitAny { handles: [4112], deadline: None }) pc=0x824ac578 lr=0x824ac578 sp=0x7111fdf0 + r0=0x82153bf0 r3=0x00000000 r4=0x00000001 r5=0x00000000 r6=0x00000000 r7=0x00000a10 + r8=0x00000010 r9=0x00000000 r10=0x00009030 r11=0x00000000 r12=0x82181988 r13=0x4adc4000 + hw=5 idx=1 tid=6 state=Ready pc=0x824ab214 lr=0x824ab214 sp=0x7117fc60 + r0=0x821511a0 r3=0x00000001 r4=0x7117fcc0 r5=0x00000001 r6=0x00000001 r7=0x00000000 + r8=0x7117fcb0 r9=0x00009030 r10=0x00000002 r11=0x00000020 r12=0x82458d68 r13=0x4adca000 + hw=5 idx=2 tid=10 state=Ready pc=0x824d1404 lr=0x824d22b4 sp=0x71487e00 + r0=0x00000000 r3=0x4250dedc r4=0x4250e040 r5=0x00000001 r6=0x00000000 r7=0x00000000 + r8=0x4b9ee000 r9=0x01010000 r10=0x01010000 r11=0x00000000 r12=0x824d22a8 r13=0x4b9ee000 + hw=5 idx=3 tid=12 state=Ready pc=0x824aa6a4 lr=0x824aa6a4 sp=0x714a7da0 + r0=0x00000000 r3=0x000000ff r4=0x00000020 r5=0x714a7df4 r6=0x00000000 r7=0x00000000 + r8=0x00000000 r9=0x00000000 r10=0x00000000 r11=0x00000001 r12=0x8217898c r13=0x4d1d2000 + + -- Handle waiter lists -- + handle=0x00001018 Semaphore(0/2147483647) waiters(tid)=[4] + handle=0x8287093c Event(sig=false, mr=false) waiters(tid)=[2] + handle=0x00001070 Thread(id=13, exit=None) waiters(tid)=[1] + handle=0x42450b5c Event(sig=false, mr=true) waiters(tid)=[7] + handle=0x00001078 Event(sig=false, mr=false) waiters(tid)=[13] + handle=0x00001080 Event(sig=false, mr=false) waiters(tid)=[5] + handle=0x828a3244 Event(sig=false, mr=false) waiters(tid)=[11] + handle=0x00001024 Semaphore(0/2147483647) waiters(tid)=[8] + handle=0x828a3220 Event(sig=false, mr=true) waiters(tid)=[11] + handle=0x00001010 Event(sig=false, mr=true) waiters(tid)=[3] + handle=0x00001050 Event(sig=false, mr=true) waiters(tid)=[8]